Fundamentals of Risk Management

Risk appetite statements
Other features associated with the risk appetite include the thought that an appetite 
will normally relate to a range of possible outcomes. Therefore, around the risk
appetite there will be a certain zone of risk exposure or level of risk that is within 
appetite. This may be referred to as the risk tolerance range for exposure to that 
particular risk. COSO (2004) defines risk tolerance as:
The acceptable level of variation relative to achievement of a specific objective, and 
often is best measured in the same units as those used to measure the related objective. 
In setting risk tolerance, management considers the relative importance of the related 
objective and aligns risk tolerances with risk appetite. Operating within risk tolerances 
helps ensure that the entity remains within its risk appetite and, in turn, that the entity 
will achieve its objectives.
It should be noted that the nature of risk appetite relates to three different con sidera-
tions. For some organizations, risk appetite may be a driver of strategy. This will be 
true for organizations such as banks and other financial institutions. For banks, risk 
is at the heart of the business and the appetite of an organization to, for example, 
lend money to particular companies or groups of people will be a reflection of its risk 
appetite and will be the main driver of the business. If risk appetite is a driver of the 
business, then the organization will wish to embrace risk in order to gain the benefits.
For many organizations, risk is not a driver of the business, but it is a consequence 
of the strategy, tactics, operations and compliance core processes that the business 
undertakes. In this case, risk appetite is unlikely to be a driver for the business but 
will be a planning mechanism for the organization to decide whether it wishes to 
adopt certain tactics, given the risks that would be embedded within those tactics, 
projects or changes. Where an organization is using risk appetite as a planning tool, 
the organization will wish to operate within certain tolerance levels and manage the 
uncertainty associated with risk.
In other circumstances, risk appetite may simply reflect the constraints that are 
placed on staff in the organization. Authorization levels, expenditure limits and 

---