Every regulated financial institution has a Risk Appetite Framework.
The harder question is:
Does it still influence decisions when the decision becomes uncomfortable?
Risk appetite is intended to connect strategy, capital, risk-taking and governance. It should help an institution define not only how much risk it is willing to accept, but where it will draw the line.
Yet a risk appetite framework can be technically sound, regularly reported and fully approved, and still have limited influence over the decisions that matter most.
That is where the real governance challenge begins.
THE SIGNAL - Being Within Appetite Does Not Always Mean Being Safe
Boards receive increasingly sophisticated risk dashboards.
Limits are monitored. KRIs are reported. Thresholds are colour-coded. Breaches are escalated.
All of this is necessary.
But a dashboard dominated by green indicators can create a dangerous sense of comfort.
The institution may still be within approved limits while risk is quietly accumulating through changing customer behaviour, sector concentration, interconnected exposures, funding dependency, third-party reliance, geopolitical developments or rapidly changing technology.
The question therefore should not only be:
“Are we within appetite?”
It should also be:
“Is our appetite still appropriate for the environment in which we are operating?”
Those are very different questions.
THE BLIND SPOT - When Risk Appetite Becomes a Reporting Exercise
One of the greatest weaknesses in risk appetite is not necessarily poor design.
It is distance from decision-making.
A framework can contain carefully calibrated metrics and thresholds but become disconnected from the conversations taking place around strategy, growth, pricing, new products, digital investment, partnerships and capital allocation.
When that happens, risk appetite starts documenting risk rather than shaping it.
This distinction matters.
If management considers risk appetite only after a strategic direction has effectively been decided, the framework becomes a validation mechanism rather than a decision tool.
Effective risk appetite should enter the conversation before commitment, not after it.
THE LEADERSHIP QUESTION - What Happens When Opportunity and Appetite Collide?
The real test of a risk appetite framework does not come when business conditions are easy.
It comes when a commercially attractive opportunity pushes against established boundaries.
A new market may offer growth but increase concentration.
A fintech partnership may accelerate digital capability while introducing third-party dependency.
An aggressive pricing strategy may protect market share while weakening risk-adjusted returns.
A funding strategy may reduce short-term costs while increasing liquidity vulnerability.
At these moments, governance is not demonstrated by simply pointing to a limit.
It is demonstrated by the quality of the discussion around the trade-off.
The board should understand:
* What are we gaining?
* What additional risk are we accepting?
* What assumptions support the decision?
* What happens if those assumptions are wrong?
* Does this decision change our aggregate risk profile?
* What would cause us to reconsider?
That is where risk appetite moves from policy into leadership.
MY LENS - Risk Appetite Should Change Decisions
After more than three decades working in risk management, one principle has become increasingly important to me:
The effectiveness of risk appetite should not be judged by the quality of the document. It should be judged by the quality of the decisions it changes.
A sophisticated framework that never causes management to reconsider a decision deserves examination.
So does a board pack in which risk appetite appears mainly as a collection of ratios, limits and traffic lights.
Risk appetite should create constructive tension.
It should occasionally cause leadership to slow down.
It should sometimes lead to a different structure, a different limit, additional mitigation—or even a decision not to proceed.
That does not make risk management anti-growth.
Quite the opposite.
Strong risk management helps an institution understand which growth it can sustain.
FROM INSIGHT TO IMPACT - Five Challenges for Leadership
1. Connect appetite directly to strategy
Every major strategic initiative should be considered against risk appetite before approval-not retrospectively.
2. Look beyond individual limits
Risks rarely develop independently. Management and boards should consider how credit, liquidity, operational, technology, geopolitical and third-party risks interact.
3. Challenge the green dashboard
Being within limits should not end the discussion. Ask what is moving beneath the threshold and whether the direction of travel matters.
4. Test appetite under stress
A limit that appears comfortable under normal conditions may look very different under severe but plausible scenarios.
5. Discuss judgment, not only metrics
Not every emerging risk can immediately be translated into a reliable number. Qualitative judgment remains an essential part of risk governance.
THE BOARDROOM QUESTION
At the next board or risk committee meeting, I would suggest asking one simple question:
“Can we identify a recent strategic decision that changed because of our risk appetite framework?”
If the answer is clear, the framework is probably influencing behaviour.
If the room struggles to identify one, that may be a more important risk signal than any traffic light on the dashboard.
Risk appetite was never intended to be another governance document.
It is meant to influence choices.
And ultimately, that is the difference between having a risk framework and leading through risk.
Dr. Nasreen Al Qaseer Risk Management Expert
THE RISK LEADER’S LENS Leading with Insight. Governing with Impact.