Board Risk Appetite: Setting It Deliberately, Not by Accident

Every board has a risk appetite already. Few have decided what it is

Most association boards have a risk appetite. Very few have decided what it is. It exists by default, formed from whichever director happens to speak loudest on a given proposal, rather than deliberately set as a governance decision the whole board owns.

What Risk Appetite Actually Means

The AICD's Not-for-Profit Governance Principles (Third Edition, 2024) make the board responsible for setting the organisation's risk appetite. The underlying tension is easy to state: a board so concerned with avoiding harm that it misses opportunities is failing as surely as one that exposes the organisation to serious harm. This framing matters because it corrects a common misconception. Risk appetite is not a synonym for risk aversion. An organisation with a low risk appetite for financial solvency might simultaneously carry a high risk appetite for advocacy positions that could upset a funder. Appetite is not a single dial. It varies by category, and a board that has never articulated which categories it treats differently is making that distinction inconsistently, decision by decision, without anyone noticing the pattern.

Who Actually Owns This Decision

The ASX Corporate Governance Council's Principles and Recommendations (4th edition), while written for listed companies, states the underlying principle cleanly: the board is ultimately responsible for deciding the nature and extent of the risks it is prepared to take to meet its objectives, while management is responsible for designing and implementing the framework that operates within that board-set appetite. This is precisely the governance and management boundary discussed earlier in this series, applied specifically to risk. Setting appetite is a governance decision the board cannot delegate away. Building the systems that keep the organisation operating within that appetite is an implementation task management should own.

A board that has never written down its risk appetite has not avoided the decision. It has simply let the decision be made informally, inconsistently, and without anyone accountable for the pattern it actually produces.

Building A Usable Risk Appetite Statement

A risk appetite statement does not need to be a lengthy document. It needs to be specific enough to actually guide a decision when one arrives. Sector guidance points to a small number of useful components: which categories of risk the organisation treats differently, financial, reputational, regulatory, safety, mission-related, and so on, the board's tolerance in each category stated in terms specific enough to be applied rather than merely aspirational (for example, "we will not budget for an operating deficit in two consecutive years"), and a connection back to the organisation's actual purpose and strategy, since a risk appetite detached from what the organisation is trying to achieve is just a list of anxieties rather than a governance tool. Appetite also cannot override legal duties: for work health and safety, privacy and similar obligations, the law sets a floor the board cannot choose to go below.

• Set risk appetite by category rather than as a single organisation-wide setting, since financial caution and advocacy boldness, for instance, can legitimately coexist in the same organisation.
• Connect appetite explicitly to purpose and strategy, so it functions as a decision-making tool rather than a static compliance document nobody actually consults.
• Assign an owner and review cycle for the risk appetite statement, whether that sits with the Finance, Audit and Risk committee discussed earlier in this quarter or a dedicated risk function, with the full board retaining final ownership of the appetite itself.
• Test contested decisions against the stated appetite explicitly in board papers, so directors can see when a proposal sits comfortably within it and when it is asking the board to extend beyond what it has previously agreed to tolerate.

The purpose of setting risk appetite deliberately is not to make a board more cautious. It is to make the board's actual tolerance for risk consistent, visible, and owned, rather than reinvented informally every time a difficult proposal reaches the table.

This is one of the practical governance topics built into our Board Director course, alongside the papers, tools and frameworks that turn the principle into your board's actual practice. Explore the course →

Annie Gibbins

General education, not legal, financial, tax, clinical or governance advice. Confirm specifics at the relevant primary source or with your own qualified adviser. Nexus Leadership is operated by Lipstick Consulting Pty Ltd · ABN 15 619 120 482.