Most association boards have a risk appetite. Very few have actually decided what it is. It exists by default, formed from whichever director happens to speak loudest on a given proposal, rather than deliberately set as a genuine governance decision the whole board owns.
What risk appetite actually means
The AICD's Not-for-Profit Governance Principles put the underlying tension precisely: boards must be careful that they are not so concerned with negative risk that opportunities are missed, but they can also not have such a disregard for risk as to expose the organisation to serious harm, and striking an effective balance between the two is the hallmark of a sound risk appetite. This framing matters because it corrects a common misconception. Risk appetite is not a synonym for risk aversion. An organisation with a genuinely low risk appetite for financial solvency might simultaneously carry a genuinely high risk appetite for advocacy positions that could upset a funder. Appetite is not a single dial. It varies by category, and a board that has never articulated which categories it treats differently is making that distinction inconsistently, decision by decision, without anyone noticing the pattern.
Who actually owns this decision
The ASX Corporate Governance Council's benchmark, while written for listed companies, states the underlying principle cleanly: the board is ultimately responsible for deciding the nature and extent of the risks it is prepared to take to meet its objectives, while management is responsible for designing and implementing the framework that operates within that board-set appetite. This is precisely the governance and management boundary discussed earlier in this series, applied specifically to risk. Setting appetite is a governance decision the board cannot delegate away. Building the systems that keep the organisation operating within that appetite is an implementation task management should own.
A board that has never written down its risk appetite has not avoided the decision. It has simply let the decision be made informally, inconsistently, and without anyone accountable for the pattern it actually produces.
Building a genuine risk appetite statement
A risk appetite statement does not need to be a lengthy document. It needs to be specific enough to actually guide a decision when one arrives. Sector guidance points to a small number of genuinely useful components: which categories of risk the organisation treats differently, financial, reputational, regulatory, safety, mission-related, and so on, the board's tolerance in each category stated in terms specific enough to be applied rather than merely aspirational, and a connection back to the organisation's actual purpose and strategy, since a risk appetite detached from what the organisation is trying to achieve is just a list of anxieties rather than a genuine governance tool.
- Set risk appetite by category rather than as a single organisation-wide setting, since financial caution and advocacy boldness, for instance, can legitimately coexist in the same organisation.
- Connect appetite explicitly to purpose and strategy, so it functions as a decision-making tool rather than a static compliance document nobody actually consults.
- Assign a genuine owner and review cycle for the risk appetite statement, whether that sits with the Finance, Audit and Risk committee discussed earlier in this quarter or a dedicated risk function, with the full board retaining final ownership of the appetite itself.
- Test genuinely contested decisions against the stated appetite explicitly in board papers, so directors can see when a proposal sits comfortably within it and when it is asking the board to extend beyond what it has previously agreed to tolerate.
The purpose of setting risk appetite deliberately is not to make a board more cautious. It is to make the board's actual tolerance for risk consistent, visible, and genuinely owned, rather than reinvented informally every time a difficult proposal reaches the table.
Explore the Board Director course
Want the fully branded, board-ready PDF of this article? Download the whole 52-part series — free.
Until next week,
Annie