Governance and Risk Appetite Statements

A risk appetite statement expresses how much ICT risk the management body is willing to accept in pursuit of its strategy, and where it draws the line. It gives managers, risk functions and the board a shared reference for decisions: which risks require escalation, which can be accepted at management level, and which must be mitigated regardless of cost or convenience. Without that reference, risk decisions are made case by case, with no consistent direction to judge them against.

Appetite under DORA governance is not a technical document alone. It is a board statement, approved by the management body, linked to services and customers, and revisited when the risk picture changes. Its value lies in the decisions it shapes. A statement that is approved and then never consulted has no governance effect, however elegantly it is written. A statement that is used to challenge a proposal, to escalate a risk, or to prioritise remediation is doing governance work.

Appetite and tolerance are related but distinct. Appetite describes the overall willingness to take ICT risk, at entity level, in pursuit of strategy. Tolerance, in the resilience context, describes the level of disruption to a particular service that would be unacceptable, often expressed in terms of customer impact and recovery expectations. Appetite sets the direction. Tolerance applies that direction to a specific service and its customers.

Appetite is set by the management body through discussion of strategy, services, customers and risk. That discussion should consider which services matter most, what disruption would mean for customers, how much dependence on providers the entity is willing to carry, and how much uncertainty it is willing to accept in recovery arrangements. The resulting statement should be clear enough to guide decisions, without pretending to quantify risks that cannot meaningfully be quantified in advance.

Appetite is used when a risk is assessed, a provider is chosen, a test finding is prioritised, or a remediation is deferred. In each case, the question is whether the proposed course sits within appetite, and if not, whether escalation to the management body is required. That escalation route is crucial. Appetite without an escalation route is merely advice, because managers can exceed it without the board ever knowing.

Escalation should be framed as normal governance, not as failure. A manager who escalates a risk that exceeds appetite is using the framework correctly, and the board response should be a decision: accept the risk explicitly, require mitigation, or change the appetite itself after proper discussion. What should not happen is silent exceedance, where a risk grows beyond appetite without any record of escalation or decision. The governance record should show where appetite was tested, what was escalated, and what was decided.

Appetite should be reviewed when strategy changes, when services or providers change materially, when incidents or tests challenge existing assumptions, or when the board finds that appetite is routinely exceeded. Routine exceedance is a signal in itself. It may mean that appetite was set unrealistically, that risk has grown, or that escalation is not working. Any of those explanations requires a board decision, not merely a note that exceedance occurred.

Review should also consider whether appetite remains understandable to those who must use it. A statement that has grown complex, or that uses language disconnected from services and customers, will not guide decisions effectively. Simplicity and service relevance are governance qualities here. A concise appetite statement that managers actually consult is more valuable than a comprehensive statement that no one reads. The board can test usability by asking how appetite influenced recent decisions, and whether managers can explain that influence in plain terms.

A common weakness is an appetite statement that is so broad that it permits everything. A statement that the entity has a low appetite for ICT risk, without any indication of what that means for services, providers or testing, gives no guidance and creates no escalation trigger. Governance should press for specificity in service and decision terms, even where precise quantification is not possible or would be misleading.

Another weakness is appetite that is set but never linked to tolerance, testing or provider decisions. In that case, appetite lives in a separate document from the work it is supposed to govern, and the two never meet. Linking appetite to those decisions, through reporting that shows where appetite was applied and where it was exceeded, keeps the statement alive. The test of an appetite statement is not whether it exists, but whether a recent difficult decision can be traced back to it.