Setting clear risk appetite and risk tolerance helps organisations make informed decisions while balancing growth opportunities and potential risks. This practical guide explains the differences between risk appetite and risk tolerance, outlines a step-by-step workshop approach, and shares best practices for aligning risk management with business strategy, governance, and organisational objectives.
Most organizations have a risk appetite statement sitting somewhere in a policy folder. Very few teams can actually explain what it means in a live decision.
That gap is exactly why risk appetite and tolerance workshops exist. Done well, a workshop turns a vague sentence like "we are moderately risk averse" into numbers, thresholds, and behaviors that people can actually use on a Tuesday afternoon when a real decision is on the table.
This guide walks through how to plan and run that kind of workshop, based on practices used across risk, audit, and governance functions worldwide.
Before any workshop starts, the room needs to agree on definitions. This sounds basic, but it is the single most common point of confusion in risk discussions.
Risk appetite is the amount and type of risk an organization is willing to pursue or retain in order to achieve its objectives. It is strategic, forward-looking, and usually expressed in qualitative or broad quantitative terms.
Think of it as the answer to: "How much risk are we willing to accept to grow, innovate, or compete?"
Risk tolerance is the acceptable variation around outcomes related to specific objectives. It is more operational, more precise, and often tied to measurable limits.
If appetite is the general direction, tolerance is the guardrail on the road.
A simple way to explain this to a non-technical audience:
Appetite: "We are comfortable expanding into new markets even if early returns are uncertain."
Tolerance: "We will not proceed if projected losses in year one exceed a defined percentage of allocated capital."
The frameworks published by COSO's Enterprise Risk Management guidance and the ISO 31000 risk management standard both treat appetite and tolerance as connected but distinct concepts, and most workshop methodologies borrow heavily from that structure.
Boards and regulators increasingly expect organizations to demonstrate, not just declare, their risk posture. According to industry reports, weak or generic risk appetite statements are among the most frequently cited gaps in governance reviews and internal audit findings.
A vague statement creates three problems in practice.
First, it gives no real guidance to frontline managers making daily calls. Second, it cannot be tested or monitored, so breaches go unnoticed until they become incidents. Third, it erodes trust between the board and management, because nobody can point to evidence that the appetite is actually being followed.
A well-run workshop fixes all three by forcing specificity early, rather than after a loss event forces the conversation.
A workshop is not a slide presentation followed by a vote. It is a structured facilitation exercise, usually spread across a few sessions rather than one long meeting.
The workshop needs a mix of people, not just the risk team. Useful participants typically include:
Senior leaders who own strategic objectives
Finance or treasury representatives who understand capital and liquidity constraints
Operational leaders who will actually apply the tolerances day to day
A facilitator from risk, audit, or an external advisor who keeps the conversation structured
Skipping operational voices is a common mistake. Appetite statements written only by senior executives often sound impressive but fail the moment someone in operations asks, "Okay, but what does this mean for my team's decisions next week?"
Every appetite discussion should start with the organization's strategic objectives, not with a blank risk matrix.
Ask the room a simple question: what are we trying to achieve in the next one to three years, and what kind of risk-taking does that require?
An organization pursuing aggressive market expansion will have a very different appetite profile than one focused on stability and cost discipline. Neither is wrong. The point is that appetite should follow strategy, not be copied from a generic template.
Once objectives are clear, the group drafts appetite statements category by category. Common categories include financial risk, operational risk, compliance risk, reputational risk, and technology or cyber risk.
Each statement should be short, specific to the organization, and written in language a non-specialist could understand. Avoid statements that could apply to almost any company in any industry.
This is where many workshops either succeed or quietly fail. Appetite alone is not actionable. Every appetite statement needs at least one measurable tolerance attached to it.
For example, a statement about being open to moderate credit risk in exchange for growth might translate into a tolerance threshold tied to a maximum default rate, a concentration limit per counterparty, or a capital buffer requirement.
The workshop facilitator should push the group past comfortable generalities and toward numbers, ranges, or clear triggers, even if those numbers are later refined by technical teams.
Once draft tolerances exist, run them against realistic scenarios. This is often the most valuable part of the session, because it exposes gaps that pure discussion never would.
A useful exercise: present the group with a plausible adverse scenario relevant to the sector, and ask whether the current draft tolerances would have triggered action in time, or whether they would have allowed the situation to worsen unnoticed.
If the answer is uncomfortable, that is the workshop doing its job.
The final output should be a concise risk appetite and tolerance document, ideally no more than a few pages, with clear ownership assigned for monitoring each tolerance threshold.
Leadership and, where relevant, the board should formally approve the document, and a review cycle should be scheduled rather than left open-ended.
A mid-sized financial services firm once ran an appetite workshop where the initial draft statement read: "We have a low appetite for reputational risk."
When the facilitator asked the group what would actually trigger action under that statement, nobody could answer. No threshold, no monitoring metric, nothing measurable.
The group spent the next ninety minutes translating that single line into three tolerance measures: a maximum number of unresolved customer complaints per quarter before executive escalation, a defined response time for social media incidents, and a threshold for negative media mentions that would trigger a communications review.
Six months later, when a minor service outage generated public complaints, the team already knew exactly which threshold had been breached and what the pre-agreed response was. No emergency meeting was needed to decide what "low appetite for reputational risk" meant in practice, because the workshop had already answered that question.
That is the practical value of doing this work properly instead of leaving it as a one-line statement in a policy document.
Even experienced facilitators run into recurring issues. Two are worth flagging specifically.
Treating appetite as a one-time exercise rather than a living document that gets revisited as strategy, markets, or regulation shift.
Setting tolerances so tight that normal business operations constantly breach them, which trains people to ignore alerts entirely.
Both mistakes quietly undermine the credibility of the entire framework, often within the first year.
Many facilitators use a basic layered diagram to help participants see how the pieces fit together:
Strategic Objectives
↓
Risk Appetite (broad, qualitative, board-level)
↓
Risk Tolerance (specific, measurable, operational)
↓
Risk Limits (hard triggers, escalation points)
Keeping this visual on the wall or slide throughout the workshop helps prevent the discussion from drifting back into abstract language once the room gets comfortable.
A workshop is only the starting point. The document it produces needs a monitoring rhythm, usually quarterly or aligned with existing risk committee cycles.
Practical ways organizations keep this alive include tying tolerance thresholds directly into existing dashboards, assigning named owners for each threshold, and revisiting the appetite statement whenever there is a material change in strategy, structure, or external environment.
Guidance from the Institute of Internal Auditors on risk governance consistently emphasizes that appetite frameworks lose value quickly when they are not integrated into regular reporting and decision-making cycles, rather than reviewed once a year in isolation.
For teams that want structured, guided practice in running these sessions rather than building the process from scratch, the Risk Appetite and Tolerance Setting Workshop course walks through facilitation techniques, statement drafting, and scenario design in more depth.
Setting risk appetite and tolerance is not a compliance formality. It is a practical exercise in helping people across an organization make faster, more consistent decisions under uncertainty.
A well-facilitated workshop, grounded in strategy and stress-tested against real scenarios, turns abstract risk language into something teams can actually use when it matters most.
1. What is the main difference between risk appetite and risk tolerance?
Risk appetite describes the broad amount and type of risk an organization is willing to accept to pursue its objectives. Risk tolerance sets the specific, measurable limits around that appetite for individual risks or objectives.
2. How often should a risk appetite statement be reviewed?
Most organizations review it at least annually, with additional reviews triggered by major strategic shifts, mergers, regulatory changes, or significant incidents.
3. Who should own the risk appetite statement?
Ultimate ownership typically sits with the board or senior leadership, with day-to-day monitoring delegated to risk management or relevant operational owners.
4. Can risk appetite differ across departments within the same organization?
Yes. Overall organizational appetite sets the boundary, but individual business units or risk categories often have their own tolerance thresholds that align with, but are more specific than, the top-level statement.
5. Is a risk appetite workshop a one-time event?
No. The initial workshop sets the foundation, but ongoing monitoring, periodic reviews, and refresher sessions are needed to keep the framework relevant as conditions change.
cyber vendor risk
Vendor risks can impact an organisation's security, compliance, finances, and operational performance. This guide explains a practical approach to identifying high-risk vendors, conducting due diligence,...
cybersecurity
Third-party vendors are essential to modern business operations, but they can also introduce operational, cybersecurity, financial, legal, and compliance risks. This guide explains how to...
corporate risk management
Risk appetite and risk tolerance are fundamental concepts in enterprise risk management, yet they are often confused. This guide explains the key differences, how each...
COSO ERM
The COSO Enterprise Risk Management (ERM) Framework helps organisations identify, assess, and manage risks while aligning risk management with strategic objectives. This guide explains the...