ISO 31000 guide
Risk appetite statement and risk criteria: setting them with ISO 31000
How to write a risk appetite statement your board owns, turn it into the risk criteria ISO 31000 places at the centre of evaluation, and design the scales, limits and escalation routes that make appetite change real decisions.
Key points
- A risk appetite statement is the board's written position on how much risk, and which kinds, the organisation will take on to reach its objectives. On its own it changes nothing; it starts to work once it is translated into risk criteria that managers apply every week.
- ISO 31000:2018 does not ask for a document called a risk appetite statement. It places the question inside risk criteria (6.3.4), which leadership sets and against which every risk is evaluated (6.4.4).
- A usable statement is short, split by risk category, mixes a qualitative stance with measurable limits and says who must be told when a limit is reached.
- The most common failure is a statement that sounds confident and is never used: no thresholds, no link to the register, no review date.
What is a risk appetite statement?
A risk appetite statement tells everyone who takes decisions what the organisation is prepared to accept in pursuit of its goals, and where it draws the line. It is approved by the board or the most senior governing body, it is organised by risk category, and for each category it answers two questions: do we seek, accept or avoid this kind of risk, and at what measurable point does a risk become too much for the person who owns it to carry alone?
Three terms are often confused, so this guide uses them consistently. Risk appetite is the broad stance, set at the top. Risk tolerance is the acceptable variation around a specific objective, usually expressed as a number or a limit. Risk criteria are the working rules that follow from both: the consequence and likelihood scales, the level at which a risk must be treated, and the level at which it must be escalated. Frameworks use slightly different words for these ideas; our guide to ISO 31000 vs COSO ERM sets the two vocabularies side by side, so it is not repeated here.
Where risk appetite sits in ISO 31000
ISO 31000:2018 treats appetite as part of the criteria rather than as a separate artefact. Four places in the guideline carry it:
- Leadership and commitment (5.2). Top management and oversight bodies own the criteria. Delegating appetite to a risk manager removes it from the people who carry the consequences.
- Scope, context and criteria (6.3, with 6.3.4 Defining risk criteria). The organisation decides what matters to it, how it will measure consequence and likelihood, and how much risk of each type it is willing to take or not take.
- Risk evaluation (6.4.4). Each analysed risk is compared with the criteria to decide whether it needs treatment, further analysis, escalation or no action beyond monitoring.
- Improvement (5.7, with 5.7.1 Adapting). When strategy, markets or obligations change, the criteria change with them.
The guideline describes what criteria should reflect; it does not prescribe a format, a number of categories or a scoring matrix. ISO/TC 262 itself, in its 2023 technical and market analysis of the 2018 edition, listed appetite, tolerance and risk acceptability among the subjects where further guidance was needed in the next revision. The method is therefore yours to design, which is both the freedom and the difficulty.
What goes into a risk appetite statement
Good statements share a shape even though their content differs by sector. Each risk category gets a short stance, one to three measurable limits and a named escalation route. Keep the categories to those the board actually debates; seven to ten is typical for a mid-sized organisation, and a single overall sentence is rarely enough to guide a decision.
| Element | What it says | Example wording |
|---|---|---|
| Purpose and authority | Who approved it, when, and which decisions it governs | Approved by the board for use in strategy, budgets, investment approval and project gates |
| Category stance | Seek, accept, cautious or averse, stated in plain language | We accept moderate risk in entering new markets where the return case is documented |
| Tolerance limits | Measurable boundaries tied to an objective | No single customer above 20% of revenue; no critical service outage beyond four hours |
| Zero-appetite areas | Where no deliberate risk is accepted, and what that means in practice | We do not knowingly breach law or regulation; any suspected breach is reported within one working day |
| Escalation | Who must be told when an indicator nears or crosses a limit | Amber to the executive committee, red to the audit and risk committee |
| Review | The review cycle and the triggers for an early review | Annually with the strategy cycle, and after any acquisition or major incident |
Zero appetite deserves care. It is appropriate for deliberate misconduct or wilful non-compliance, but no organisation can guarantee zero incidents. Write the zero as a stance on conduct and pair it with a response time, not as a promise that nothing will ever go wrong.
From appetite to risk criteria: a worked example
Take a customer-contact BPO in the Philippines with 1,200 staff serving clients in banking and retail. Its board agrees three stances: cautious on service continuity, averse on client data protection, and open on growth through new service lines. The risk team then turns each stance into criteria that a team leader can apply without phoning head office.
| Board stance | Risk criterion that follows | Decision rule |
|---|---|---|
| Cautious on service continuity | Consequence scale: a major rating means a client service down for more than four hours or a missed contractual service level for two consecutive months | Any risk rated major and likely or above needs a treatment plan approved by the operations director |
| Averse on client data protection | Any credible exposure of client personal data is rated at the top of the consequence scale, whatever its likelihood | Escalated to the executive committee within one working day; treatment is mandatory, not optional |
| Open on new service lines | A new line may run below target margin for its first year if the risk assessment and exit criteria are documented | Approved by the chief executive at the investment gate; reviewed quarterly against the exit criteria |
The statement stayed short, but each line now changes a real decision: who approves a treatment plan, how fast a data incident moves up, and when a loss-making pilot stops. A fintech in India or a software start-up in the United States would follow the same logic with different limits.
Consequence and likelihood scales that match the appetite
Criteria are only as useful as the scales behind them. Four design choices decide whether yours will be used:
- One set of scales across the organisation. When finance, safety and information security each score on their own matrix, the board cannot compare risks. Keep one enterprise scale and let functions add detail beneath it.
- Consequence rows for every category in the statement. Financial, service, people, legal, reputation and data each need a description at every level, written in the organisation's own units.
- Likelihood defined in time and frequency. "Possible" means little until it reads "could happen once in the next three years".
- Thresholds drawn from the statement, not from habit. The coloured zones of a heat map are decisions about appetite. Where the board is averse, the red zone starts lower.
Choosing how to analyse risks against these scales, from simple matrices to scenario analysis, is covered in our guide to risk assessment techniques from IEC 31010.
Why risk appetite statements fail
Most failures are predictable, and each has a simple fix.
- Aspirational wording only. "We have a low appetite for reputational risk" guides no one. Add at least one measurable limit per category.
- Written by the risk function alone. If the board did not debate it, managers will treat it as paperwork. Hold the approval discussion in the board meeting, with minutes that record the debate.
- No link to the register. If risk ratings are not compared with the limits, the statement and the register tell different stories. Build the thresholds into the register itself.
- Never reviewed. A statement written before an acquisition, a new market or a major incident is out of date. Set review triggers as well as a calendar date.
Keeping appetite current and visible
Appetite becomes real through monitoring and review (6.6) and recording and reporting (6.7). Give each tolerance limit a key risk indicator with amber and red points, an owner and a reporting frequency. Report to the board on the few indicators near or beyond their limits rather than the whole register, and record the decision taken: accept for a defined period, treat, or change the limit. That record is the evidence that appetite governs decisions, and it is what an internal audit or an independent review of the framework will look for first.
Record and communicate every change to categories, limits or scales so that everyone scores against the current version.
How Sterling sets risk appetite and criteria
From a board discussion to criteria your managers use
Sterling's expert and experienced consultants facilitate the leadership workshop that agrees the stances, draft the statement with your executive team, build the consequence and likelihood scales and thresholds that follow from it, and set the indicators and escalation routes in Effivity so that the register and the statement stay aligned. ISO 31000 is guidance and carries no certificate; what we deliver is a framework your board owns and your teams use. We ensure our clients put the standard in place successfully.
Book a free discovery callRisk appetite and risk criteria: questions buyers ask
What is the difference between risk appetite and risk tolerance?
Risk appetite is the broad amount and type of risk the board is willing to pursue, while risk tolerance is the measurable limit set for a specific objective or category. Appetite says "cautious on service continuity"; tolerance says "no critical outage beyond four hours".
Does ISO 31000 require a risk appetite statement?
No, ISO 31000:2018 is guidance and does not require any specific document. It expects leadership to set risk criteria that reflect the amount and type of risk the organisation will take, and many organisations record that decision as a risk appetite statement.
Who should approve the risk appetite statement?
The board or the most senior governing body should approve it, usually on the recommendation of an audit and risk committee. Management drafts and operates it, but ownership of the stance stays at the top.
How long should a risk appetite statement be?
Two to four pages is enough for most organisations. Length comes from detail in the criteria and scales that sit beneath the statement, not from the statement itself.
How often should risk appetite be reviewed?
Review it at least annually with the strategy and budget cycle, and earlier after a major change such as an acquisition, entry into a new market, a new regulation or a serious incident.
Can different subsidiaries have different risk appetites?
Yes, a subsidiary can set tighter limits than the group, but it should not set looser ones without group approval. Keep one enterprise scale so that risks remain comparable when they are reported upwards.
More ISO 31000 guides
Every guide in the ISO 31000 series is written for one question and links back to the hub for the whole picture.
Keep exploring
Explore more about ISO 31000
Watch a video on how to implement ISO 31000 here.
Watch a video on ISO 31000 guidelines here.
Talk to a consultant
Set a risk appetite your board owns and your managers use.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice