Risk appetite is the type and amount of risk an organization is willing to accept while pursuing growth and value. A growing business should set it by connecting strategic goals to financial capacity, operational limits and non-negotiable obligations, then turning those choices into measures people can use.
The aim is not to avoid risk. Growth requires investment, new customers, hiring and change. The aim is to make deliberate choices before sales pressure, optimism or urgency pushes the company beyond what it can manage.
In this article
What does risk appetite mean?
Risk appetite guides strategic choices, while tolerances and limits guide execution.
- Risk capacity: the maximum exposure the business can bear without threatening viability, legal duties or essential operations.
- Risk appetite: the broad type and amount of risk it chooses to accept in pursuit of value.
- Risk tolerance: the acceptable variation around a specific objective or performance target.
- Limit or trigger: a measurable boundary that requires action, approval or escalation.
COSO defines appetite at a broad organizational level and links it to value, strategy and objectives. These terms vary slightly across frameworks, so leaders should agree on their meaning and use them consistently.
Why does risk appetite change during growth?
Growth changes both the risks worth taking and the business’s ability to absorb a setback.
A new market, product, facility or major customer can create attractive returns while increasing working-capital needs, concentration, hiring pressure and operational complexity. Capacity may improve as cash and capability grow, or weaken when debt, fixed cost and service demands rise.
COSO notes that appetite should adapt to changing conditions and be revisited when strategy changes. This does not mean changing boundaries whenever a target is difficult. It means reassessing them when the objective, exposure, resources or stakeholder expectations have materially changed.
7 steps to set risk appetite
A useful framework starts with strategy and ends with decisions, measures and accountability.
1. Start with strategic objectives
Choose a small number of material objectives, such as entering a province, adding capacity or launching a service. Ask what risk must be taken to succeed and what outcomes would make the strategy unacceptable.
2. Establish capacity and non-negotiables
Assess cash headroom, debt terms, insurance, management capacity, systems, recovery options and contractual obligations. Set very low appetite for unlawful conduct, preventable safety harm, fraud and deliberate privacy breaches. Capacity should constrain appetite, even when opportunity looks strong.
3. Select the material risk categories
Focus leadership attention on the risks that could change the strategy. These often include financial, customer, people, operational, cyber, compliance and reputation risk. Treasury Board guidance recommends a manageable set proportionate to organizational size and complexity.
4. Write plain-language appetite statements
Describe both the opportunity and the boundary. For example: “We accept measured investment risk to enter adjacent Canadian markets, provided the initiative preserves minimum cash headroom and can be paused without disrupting core customers.” Avoid vague labels without decision meaning.
5. Convert statements into tolerances and limits
Choose leading and outcome measures. Examples include cash runway, customer concentration, defect rate, system downtime and unfilled critical roles. Set a target, warning level and hard boundary. Define the required response at each point.
6. Assign decision rights and escalation
The board or owners approve the overall appetite. Management allocates limits, monitors exposure and acts on warnings. State who may approve an exception, for how long, with what evidence, and when a breach must reach senior leadership.
7. Test, monitor and review
Apply the framework to recent and proposed decisions. If leaders reach different answers, the wording or measures need work. Use scenario analysis to test whether limits remain credible under difficult conditions. Review performance regularly and revisit appetite when strategy, capacity or the external environment changes.
Examples of practical risk appetite measures
Each measure should help someone approve, reject, pause or escalate a decision.
| Risk area | Possible appetite stance | Example measure |
|---|---|---|
| Growth investment | Moderate for adjacent markets | Maximum investment and payback range |
| Liquidity | Low for loss of cash headroom | Minimum cash runway or covenant buffer |
| Customers | Moderate during early expansion | Revenue share from the largest customer |
| Operations | Low for failure of critical service | Maximum outage or order delay |
| Safety and compliance | Very low | Reportable incidents and overdue controls |
These are examples, not recommended limits. The right thresholds depend on the business model, sector, obligations and capacity. A company should also avoid rewarding growth in ways that encourage people to cross approved boundaries.
An illustrative Canadian growth decision
A clear appetite can turn an argument about ambition into a decision about conditions.
Consider an illustrative Ontario distributor considering a large national customer. The contract would increase revenue quickly but require inventory, hiring and extended payment terms. Management’s appetite allows customer concentration during expansion only if cash runway stays above its approved floor and service capacity passes a readiness test.
The company could stage the contract, negotiate deposits and add a second supplier before increasing volume. If cash or service indicators reach warning levels, further rollout pauses. This approach supports growth while protecting the core business. Praevion’s guide on business readiness to scale offers related checks.
Common risk appetite mistakes
The framework fails when it remains a policy document rather than a decision rule.
- Using only broad labels such as low, medium and high.
- Setting appetite above the organization’s financial or operational capacity.
- Treating all risk categories the same.
- Choosing lagging measures that reveal a problem too late.
- Allowing exceptions without an owner, expiry date or recovery plan.
- Reviewing appetite annually even when strategy changes sooner.
Frequently asked questions
These answers clarify three common governance questions.
Who should approve risk appetite?
The board, owners or equivalent governing body should approve the overall appetite. Senior management should translate it into operating limits, responsibilities and reporting.
How often should risk appetite be reviewed?
Review it formally at least annually and whenever strategy, financing, capacity, regulation or operating conditions change materially. Monitor related indicators more frequently.
Can a growing SME use a simple framework?
Yes. A short framework covering key objectives, appetite statements, measures, warning levels, hard limits and owners is often more useful than a complex document nobody uses.
Create boundaries that support growth
Effective risk appetite gives people room to act and makes the point of escalation clear.
Praevion Consulting Inc helps Canadian leadership teams connect growth plans with capacity, practical limits and accountable decision rights. To build a framework suited to your strategy and operating model, contact Praevion Consulting Inc.
Sources
Canadian guidance and international risk standards informed this article.
Photo credits: Memento Media, Ruchindra Gunasekara, Spencer Davis and Christina @ wocintechchat.com M on Unsplash.
