How to Write a Risk Appetite Statement

What a risk appetite statement actually is

The FSB defines a risk appetite statement as the articulation in written form of the aggregate level and types of risk that a firm is willing to accept, or to avoid, in order to achieve its business objectives. It is not a compliance artefact filed away after board approval. It is meant to be easy to communicate, easy for stakeholders to understand, and directly linked to the firm's strategy.

Critically, the FSB says a statement must contain both qualitative statements and quantitative measures. The quantitative side expresses appetite in terms such as earnings, capital, liquidity-at-risk or other relevant metrics that can be aggregated and disaggregated. The qualitative side sets the overall tone for risk taking and articulates clearly why the firm takes on or avoids certain types of risk. The FSB is explicit that the statement should also address risks that are harder to quantify, including reputation and conduct risks, money laundering and unethical practices.

A statement can span more than one document, but the FSB stresses that where it does, the parts must form a coherent whole so the board obtains a holistic yet compact view. In other words, if a reader cannot tell from your materials how much risk the firm is willing to accept and why, the statement is not doing its job.

Capacity, appetite, tolerance and limits: the terms that matter

Most weak statements fail because the drafters blur four distinct ideas. The FSB glossary keeps them separate, and getting the language right is the first discipline of writing a good statement. Risk capacity is the ceiling set by your resources and obligations. Risk appetite is the level you choose to operate at within that ceiling. Limits are how that appetite is allocated to the business. Tolerance, in FCA language, is simply the level of risk the firm is prepared to accept, which can be set as an overall statement or broken down by business unit.

The FSB deliberately narrows its own vocabulary. It notes that the terms risk appetite, risk tolerance and risk limits are used by different authors with slightly different meanings, so for clarity it uses only risk appetite and risk limits. UK firms should pick their own consistent definitions and stick to them, because a statement that uses appetite and tolerance interchangeably in different sections invites exactly the confusion the framework is trying to remove.

The table below sets out the four terms using the FSB definitions and the FCA wording, so you can lift a consistent glossary straight into your own policy.

How SYSC 7 frames the requirement

The FCA's risk control rules sit in SYSC 7.1. SYSC 7.1.2 R requires a firm to establish, implement and maintain adequate risk management policies and procedures, including effective procedures for risk assessment, which identify the risks relating to the firm's activities, processes and systems and, where appropriate, set the level of risk tolerated by the firm. That last phrase is the regulatory hook for a risk appetite statement: setting the level of risk you tolerate is the substance of the exercise.

The Handbook then requires the firm to adopt effective arrangements, processes and mechanisms to manage that risk in light of the level of risk tolerance it has set, and it confirms that the level of risk tolerated can be expressed either as an overall statement or as various risk tolerances for individual business units. SYSC 7.1.5 R goes further, requiring the firm to monitor compliance with those arrangements and the adequacy and effectiveness of the measures taken to address any deficiencies.

Ownership is explicit. SYSC 7.1.6 R requires the management body to approve and periodically review the strategies and policies for taking up, managing, monitoring and mitigating the risks the firm is or might be exposed to, including those posed by the macroeconomic environment in relation to the status of the business cycle. Note the scope: many of these SYSC 7.1 provisions apply as rules to common platform firms and certain other firms, and other firms should take account of them as if they were guidance. Either way, the direction of travel is the same, so build your statement to the standard and record which parts bind you as rules. You can read how we help firms operationalise this in our governance and controls tooling.

What the PRA expects from the board

For PRA-regulated firms the expectations are set out in the PRA's approach to banking supervision. The PRA expects firms to articulate the amount of risk they are willing to take across different business lines to achieve their strategic objectives, and it expects that risk appetite to be consistent with the regulator's objectives and supported by proper attention to identifying, measuring and controlling risks, including those arising in unlikely but very severe scenarios.

The board sits at the centre. The PRA says the board should articulate and maintain a culture of risk awareness and ethical behaviour for the whole organisation to follow, and that boards should ensure they receive adequate and timely information on key risks and on variances from the firm's agreed risk appetite so they can monitor and challenge executive management. Reporting is expected to flag risks that fall outside the agreed appetite.

The PRA also expects escalation to match significance. Key decisions, both on assuming new risks and managing existing ones, should be taken at the appropriate level, including at board level where they are sufficiently important, with risks outside the agreed risk appetite and key sensitivities highlighted. A statement that never triggers a board conversation when a threshold is breached is not being used as intended.

Writing the statement, step by step

A risk appetite statement is developed top down and bottom up. The FSB describes setting the institution-wide appetite as the first step, after which the aggregate appetite is allocated down to business lines and other levels in alignment with the firm's strategic and business plans. That allocation needs input from the business, not just the centre, which is why the drafting process matters as much as the final wording.

The steps below follow the FSB's own description of what an effective statement should do, adapted for a UK firm working to SYSC 7. Treat them as a drafting order rather than a one-off checklist, because the statement should be revisited whenever strategy, capacity or the risk profile shifts.

Cascading appetite into limits and monitoring

A statement only changes behaviour once it becomes measurable limits that people work to. The FSB defines risk limits as the allocation of the aggregate risk appetite to business lines, legal entities, specific risk categories and concentrations. It says limits should be specific and sensitive to the actual shape of portfolios, measurable, frequency based, reportable and built on forward looking assumptions. It also warns that limits should not be overly complicated, ambiguous or subjective, and should not simply default to regulatory limits or peer benchmarks.

Measurable limits are your defence against unknowingly exceeding capacity as conditions change. The FSB notes that having limits which can be measured helps prevent a firm from breaching its risk capacity as markets move, and acts as a defence against excessive risk taking. For risks that resist numbers, such as reputation risk, limits should still be measurable even through qualitative assessment, which stops conduct and reputational exposures from falling outside the framework.

Monitoring closes the loop. SYSC 7.1.5 R requires firms to monitor the adequacy and effectiveness of their risk management policies and the measures taken to address deficiencies, and the PRA expects timely reporting of variances from agreed appetite. Build the reporting so that a breach is visible, owned and escalated rather than quietly absorbed. If you are standing up this framework as part of an authorisation application, our authorisation support can help you evidence it to the regulator.

Conclusion

A risk appetite statement is worth writing only if it is used. The regulatory anchors are clear: SYSC 7 requires firms to set the level of risk they tolerate and requires the management body to approve and periodically review the underlying strategies, while the FSB and PRA set out what a credible statement contains and how the board should own it. Keep the four terms distinct, pair quantitative measures with honest qualitative statements about conduct and reputation, and make sure the aggregate appetite cascades into limits that people actually work to.

Above all, avoid the rubber stamp. The FSB warns supervisors to check that boards do not merely rubber stamp management's recommendation, and the PRA expects boards to see and challenge variances from appetite. Treat the statement as a living instrument that gets revisited when strategy, capacity or the risk profile moves, and it becomes one of the most useful governance documents your firm holds.

Frequently asked questions