Operationalising Risk Appetite
When every programme independently minimises its own risk, the portfolio as a whole becomes incapable of the very transformation that the board has commissioned.
The Conversation That Never Happens
Every board I have worked with in the past decade claims to understand risk. Risk registers are maintained, risk committees convene, and risk appetites are declared in strategy documents with phrases such as “moderate” or “balanced.” And yet, when a major programme reaches the point where a genuine risk decision is required — whether to proceed with a regulatory deadline in doubt, whether to accept a scope reduction that changes the business case, whether to invest further in a failing initiative or cut losses — the conversation that follows is almost never grounded in the risk appetite the board has declared.
The reason is straightforward: the risk appetite was never real. It was a statement of aspiration, not an operational framework. It described a posture without defining the boundaries within which that posture would hold. And without those boundaries, every risk decision defaults to the path of least political resistance, which in most organisations means risk aversion.
The Abstraction Problem
Risk appetite statements in most organisations exist at a level of abstraction that renders them useless for decision-making. A statement such as “the organisation has a moderate appetite for strategic risk” tells a programme board nothing about whether to approve a six-month delay to a regulatory programme, whether to accept a technology platform that has not been proven at scale, or whether to proceed with a business change that will disrupt a revenue-generating operation during its peak period.
The abstraction is not accidental. Defining risk appetite in concrete, operational terms is uncomfortable. It requires the board to say, explicitly, how much money it is willing to lose, how much schedule overrun it will tolerate before intervening, what level of operational disruption it considers acceptable during a transition, and what regulatory risk it is prepared to carry. These are not theoretical questions — they are questions that, once answered, constrain the board’s future freedom of action. And boards, in my experience, are reluctant to constrain themselves.
The result is a governance vacuum. Programme boards and steering committees are asked to make risk decisions without a framework for making them. Each decision is treated as unique, debated on its merits in isolation, and resolved through the political dynamics of the room rather than against a set of agreed boundaries. The quality of risk decisions becomes a function of who is present, who speaks loudest, and what mood the sponsor is in — none of which constitutes governance.
Risk Aversion as the Default
In the absence of a genuine risk appetite framework, organisations default to risk aversion. This is rational at the individual level — no programme director wants to be the person who accepted a risk that materialised — but it is deeply damaging at the portfolio level.
When every programme independently minimises its own risk, the portfolio as a whole becomes incapable of the very transformation that the board has commissioned. The sum of individually rational risk decisions is a collectively irrational outcome.
The pattern is visible across sectors. Transformation programmes accumulate contingency upon contingency, extend timelines to reduce delivery risk, descope ambitious elements to remove uncertainty, and add governance layers to demonstrate control. Each of these decisions can be justified on its own terms. But collectively, they transform a bold change agenda into an incremental improvement programme that delivers a fraction of the intended value at a multiple of the intended cost.
The board, which commissioned the transformation and declared its appetite for strategic risk, is rarely aware that its own governance structures are systematically de-risking the programme into irrelevance. The status reports show green. The milestones are being met — because the milestones have been redefined to match what can be delivered without taking risk. The gap between what was commissioned and what is being delivered widens invisibly, and the board discovers the truth only when the programme closes and the benefits case is reviewed.
What an Operational Risk Appetite Looks Like
The alternative is not complicated in concept, though it requires courage in practice. An operational risk appetite framework translates the board’s strategic posture into specific, measurable boundaries that programme governance can use.
This means defining, for each major programme or portfolio:
- The maximum schedule variance the board will tolerate before requiring an escalation decision — not a report, a decision.
- The financial exposure ceiling beyond which the board must explicitly re-approve the investment, rather than allowing incremental budget increases to accumulate unchallenged.
- The categories of operational risk the board is willing to carry during transition — service disruption, temporary capability gaps, customer impact — and the limits within each category.
- The regulatory risk boundaries: what level of non-compliance the organisation will accept during a transition period, and for how long.
These boundaries do not remove judgement from governance — they frame it. A programme board that knows the board’s tolerance for schedule variance can make a faster, better-informed decision about whether to accept a delay or invest in acceleration. A steering committee that knows the financial exposure ceiling can escalate at the right moment rather than allowing costs to drift.
Why Boards Resist
The resistance to operational risk appetite frameworks is not ignorance — it is politics. Defining concrete risk boundaries exposes the board to accountability. A board that has said “we will tolerate up to three months of schedule variance before requiring re-approval” can be held to account if a programme drifts for six months without escalation. A board that maintains an abstract “moderate risk appetite” can always claim, after the fact, that the specific risk in question was outside its appetite.
The abstraction, in other words, is a form of optionality. It preserves the board’s ability to judge each situation with hindsight, to claim that risks that materialised were unacceptable while risks that did not were evidence of good governance. This is not governance — it is retrospective rationalisation.
The Governance Foundation
Risk appetite is not a peripheral element of governance — it is the foundation on which every other governance mechanism depends. Stage gates are meaningless without criteria, and the most important criteria are risk-based. Escalation processes are ineffective without thresholds, and the thresholds that matter are risk thresholds. Assurance is theatre without standards, and the standards that drive real assurance are risk standards.
The organisations that govern transformation effectively are those that have had the uncomfortable conversation — the one where the board defines, in terms that are specific enough to be useful and uncomfortable enough to be real, what risks it is prepared to take and what risks it is not. Until that conversation happens, governance will continue to default to risk aversion, transformation programmes will continue to be descoped into mediocrity, and boards will continue to wonder why the bold agenda they commissioned delivered incremental change.