Risk Appetite Is Revealed in Behaviour, Not Documents

Most boards believe they have a clear view of their organisation’s risk appetite. There is usually a statement approved annually, often supported by metrics, tolerances, and heat maps. It is discussed seriously, minuted carefully, and referenced in governance papers. From a procedural perspective, appetite appears well established.

Yet when failures occur, risk appetite is rarely mentioned as a live influence on decision-making. It is rediscovered retrospectively, usually as something that was “in place” rather than something that shaped behaviour.

This is not because boards misunderstand the importance of risk appetite. It is because appetite is commonly treated as an artefact, when in reality it is a behavioural signal.

Risk appetite is not what an organisation says it is willing to accept. It is what the organisation routinely tolerates, rewards, or ignores. It is revealed in trade-offs, not in statements. In moments of tension, behaviour speaks more clearly than documentation ever can.

Consider how investment decisions are made under pressure. Consider how targets are set, stretched, or quietly recalibrated. Consider what happens when performance is strong but conduct is questionable, or when delivery is late but risk controls are formally intact. These are the moments when appetite is expressed, often unconsciously.

In many organisations, the formal appetite statement occupies a narrow governance space. It is discussed at a particular point in the annual cycle, then largely disappears from view. Meanwhile, the real appetite is shaped elsewhere: in incentives, promotions, resourcing decisions, and informal signals from senior leadership.

This creates a persistent disconnect. Boards believe they have articulated appetite, while the organisation learns it experientially. Over time, people stop looking to the statement for guidance and start reading the system instead.

One reason this happens is that appetite statements are often framed in abstract or generic terms. They describe tolerance for categories of risk without confronting the lived tensions that actually matter. How much delivery risk is acceptable in pursuit of growth? How much cultural strain is tolerable to meet targets? How much uncertainty can be carried without resolution?

These questions cannot be answered once a year. They are negotiated continuously through behaviour.

Another reason is that appetite statements are frequently insulated from consequence. Decisions that sit outside stated appetite are rationalised, deferred, or reclassified rather than challenged directly. When exceptions accumulate without consequence, the signal is clear: the statement is aspirational, not binding.

Over time, this erodes the statement’s credibility. Appetite becomes something that exists for governance compliance, rather than something that constrains or enables judgement. The organisation adapts accordingly.

This is not a failure of intent. Boards often want appetite to guide decision-making. The difficulty is that appetite cannot be imposed solely through articulation. It emerges from patterns of reinforcement. What is challenged repeatedly is perceived as risky. What is tolerated repeatedly becomes normal.

This is why risk appetite is so closely linked to trust and sensemaking. If people believe that raising concerns will be heard and acted upon, appetite remains live. If they believe that delivery will always trump discomfort, appetite quietly shifts, regardless of what the document says.

Importantly, this also explains why appetite failures are often invisible until late. Because appetite is behavioural, it drifts gradually. Small accommodations accumulate. Each individual decision appears reasonable in context. Only in retrospect does the pattern become clear.

Boards often respond by refining the statement. More metrics are added. Thresholds are clarified. Visualisations improve. But if the underlying behavioural signals remain unchanged, these refinements have limited effect.

The uncomfortable implication is that boards do not control risk appetite primarily through approval. They do so through what they attend to, what they question, and what they are prepared to slow down or stop. Appetite is shaped less by what is written and more by what is allowed to continue.

This does not make appetite vague or unmanageable. It makes it more demanding. Governing appetite requires boards to stay close to the lived tensions of the organisation, not just its declared positions.

Risk appetite, properly understood, is not a static declaration of tolerance. It is a dynamic expression of what the organisation is prepared to trade off, again and again. The question is not whether the statement exists, but whether behaviour still aligns with it.