- Be clear on why Boards should care about risk appetite. The key reason is because it drives the behaviour of the executive, management and staff. It is closely linked with ensuring the organisation has realistic objectives aimed at fulfilling the organisation’s purpose.
- Through the appropriate channels, offer to have a session with the Board to develop a risk appetite statement (download a sample risk appetite here) and be clear on why. Use their language not risk-speak. If they agree, all is good.
- If the Board does not agree to have a discussion on risk appetite and delegates the task to management, prepare the statement with senior management and forward it onto the Board for review with a paragraph along the following lines: “The attached risk appetite statement will be disseminated to and used by staff and the executive to inform their decision-making. Furthermore, the statement will be used to confirm risk reporting triggers when certain risks need to be reported to higher levels of management and ultimately to the Board.”
In my experience, presenting a risk appetite statement to a Board in this way leads to a full discussion between the Board and management and more often than not, the senior risk officer is invited to lead the discussion. The Board becomes engaged and now has further basis for querying why a decision has or has not come to the Board for approval.