The Conversation Boards Avoid
Most boards can tell you what risks they are managing; almost none can tell you how much risk they have consciously chosen to accept, and why.
The Missing Foundation
Every large organisation has a risk management framework. Most have risk registers, risk committees, risk reporting processes, and risk escalation procedures. The infrastructure of risk governance is, in most sectors, extensive and well-established. And yet, beneath all of this infrastructure, a foundational question remains almost universally unanswered: how much risk is this organisation willing to accept?
This is not a theoretical concern. Risk appetite — the articulation of how much risk an organisation consciously chooses to carry in pursuit of its objectives — is the logical starting point for every risk-related governance decision. Without it, every other element of the risk framework operates in a vacuum. A risk register that categorises risks as high, medium, or low is meaningless if there is no agreed definition of what level of risk the organisation considers acceptable. An escalation process that routes high-rated risks to the board is pointless if the board has never articulated what it would do differently upon receiving them.
The pattern I observe repeatedly is this: organisations build elaborate risk management machinery and then operate it without ever having the conversation that would give it purpose.
Why the Conversation Does Not Happen
The absence of a clear risk appetite statement is not an oversight. It is, in most cases, a deliberate — if unconscious — avoidance. There are several forces that sustain this avoidance, and understanding them is essential to addressing it.
Risk appetite requires commitment. To state a risk appetite is to make a choice, and choices create accountability. If a board states that it is willing to accept a certain level of delivery risk in its transformation portfolio, it has implicitly accepted responsibility for the consequences if that risk materialises. Most boards prefer the flexibility of ambiguity. Without a stated appetite, every risk decision can be assessed on its own merits — which in practice means assessed in the light of whatever political and reputational pressures are most acute at the time.
Risk appetite exposes disagreement. Any attempt to articulate risk appetite across a board or executive team will surface fundamental disagreements about strategy, priorities, and values. The finance director’s risk appetite for technology investment is likely to differ markedly from the technology director’s. The chief executive’s appetite for reputational risk may conflict with the commercial director’s appetite for market risk. These disagreements exist whether or not they are surfaced, but surfacing them is uncomfortable — and most governance cultures are designed to manage discomfort, not to seek it out.
Risk appetite is difficult to express. Even where the will exists, the mechanics are challenging. Risk appetite is not a single number or a simple statement. It varies by risk category, by time horizon, by strategic context. Expressing it in terms that are both meaningful and operational requires a sophistication of risk language that most boards do not possess — not because they lack intelligence, but because they have never been required to develop it.
The avoidance of risk appetite is not a gap in process. It is a governance culture that has learned to manage risk without ever confronting how much risk it is prepared to take.
The Consequences Downstream
The absence of an articulated risk appetite creates a cascade of governance failures, each of which is visible in its own right but rarely traced back to this root cause.
Risk Registers Without Context
The most immediate consequence is that risk registers become exercises in documentation rather than instruments of decision-making. A risk rated as “high” on a standard probability-impact matrix tells the reader that something significant could happen. It does not tell the reader whether the organisation should be concerned — because concern requires a reference point, and that reference point is risk appetite.
In the absence of appetite, risk registers tend toward two failure modes. Either everything is rated high — because no one wants to be responsible for under-rating a risk that subsequently materialises — or the ratings become political, calibrated to the perceived preferences of the audience rather than to any objective assessment. Both failure modes are rational responses to the absence of a standard against which to calibrate.
Inconsistent Decision-Making
Without a stated risk appetite, risk-related decisions are made on a case-by-case basis, with no consistent standard applied across them. The same organisation that accepts significant delivery risk on a high-profile strategic programme may reject a much smaller risk on a routine operational change — not because the risk profiles are genuinely different, but because the decision-makers, the political context, and the prevailing mood are different.
This inconsistency is corrosive. It teaches programme teams and operational managers that risk decisions are unpredictable, which in turn encourages them to either over-mitigate everything — driving up cost and slowing delivery — or to avoid surfacing risks at all, on the grounds that the response is likely to be disproportionate and unhelpful.
The Escalation Spiral
A particularly damaging pattern is the escalation spiral that emerges when risk appetite is undefined. Because there is no agreed threshold for what constitutes an acceptable risk, decision-makers at every level tend to escalate upward. They do so not because they believe the risk requires senior attention, but because they are unwilling to take personal responsibility for accepting a risk that has no organisationally sanctioned acceptance level.
The result is boards and executive committees overwhelmed with risk decisions that should have been resolved two or three levels below. The board, in turn, lacks the operational context to make these decisions well, and so either defers them back downward — creating a circular pattern of escalation and deferral — or makes decisions that are poorly informed and poorly calibrated to the operational reality.
What a Genuine Risk Appetite Framework Requires
Building a meaningful risk appetite is not primarily a technical exercise, although it has technical components. It is fundamentally a leadership exercise — a structured conversation among the senior leaders of an organisation about what they are trying to achieve and how much uncertainty they are willing to accept in pursuit of it.
The organisations I have seen do this effectively share several characteristics.
They start with strategy, not with risk. The conversation begins not with “what risks are we willing to accept?” but with “what are we trying to achieve, and what would we be willing to sacrifice to achieve it?” This reframing is important because it connects risk appetite to purpose rather than to fear. An organisation that begins with its strategic objectives can work backward to the risks inherent in pursuing them and make conscious choices about which of those risks it will carry.
They differentiate by category. A single organisational risk appetite is too blunt to be useful. Effective frameworks distinguish between categories — financial risk, operational risk, reputational risk, regulatory risk, strategic risk — and articulate a different appetite for each. An organisation might have a high appetite for strategic risk (willingness to pursue uncertain opportunities) and a low appetite for regulatory risk (unwillingness to operate outside compliance boundaries). Making these distinctions explicit is what gives the framework operational value.
They express appetite in terms that connect to decisions. The weakest risk appetite statements are those expressed in abstract terms — “the organisation has a moderate appetite for risk.” This tells decision-makers nothing they can act on. Effective statements are expressed in terms that connect directly to the decisions people actually face: the maximum acceptable cost overrun on a programme before escalation is required, the minimum probability of regulatory compliance before a new product can be launched, the maximum period of service disruption the organisation is willing to tolerate from a technology change.
They revisit appetite regularly. Risk appetite is not a fixed characteristic of an organisation. It changes with strategic context, market conditions, leadership, and institutional confidence. The organisations that use risk appetite effectively treat it as a living instrument — reviewed and, where necessary, adjusted at least annually, and always revisited when the strategic context shifts significantly.
“Most boards can tell you what risks they are managing; almost none can tell you how much risk they have consciously chosen to accept, and why.”
The Leadership Dimension
The reason risk appetite remains undeveloped in so many organisations is ultimately a leadership issue, not a process issue. Articulating risk appetite requires senior leaders to do something that governance culture rarely demands of them: to make an explicit, documented commitment about the boundaries of acceptable uncertainty, and to be held accountable for that commitment.
This is a different kind of leadership from the kind most governance frameworks require. Standard governance asks leaders to review, to challenge, to approve or reject. Risk appetite asks them to declare — to say, in advance of any specific decision, what they consider acceptable and what they do not. It is a proactive act rather than a reactive one, and it requires a confidence in one’s own judgement that is difficult to sustain when the consequences of getting it wrong are asymmetric. No executive was ever criticised for being too cautious. Many have been criticised for accepting a risk that subsequently materialised.
This asymmetry is the heart of the problem. Until organisational culture evolves to reward the conscious, well-reasoned acceptance of risk as highly as it rewards the avoidance of it, the incentive for leaders will remain firmly on the side of ambiguity. And the risk appetite conversation will remain the one that boards know they should have but consistently find reasons to defer.
A Foundation Still Being Laid
The trajectory is, slowly, in the right direction. Regulatory pressure in financial services is beginning to require more explicit articulation of risk appetite at board level. Some public-sector organisations, driven by the accountability demands of parliamentary oversight, are developing more structured approaches. And a small but growing number of organisations across sectors are recognising that the absence of risk appetite is not merely a governance gap but a strategic vulnerability — an inability to make consistent, well-calibrated decisions about the risks inherent in their own strategy.
But progress is slow, and the forces of avoidance are strong. The conversation that boards avoid is, not coincidentally, the conversation that matters most. Until risk appetite moves from an aspiration to an operational reality — embedded in decision-making, connected to strategy, and owned by the leaders who set it — the elaborate machinery of risk governance will continue to operate without the one thing that would give it meaning: a clear, conscious, collectively owned answer to the question of how much risk this organisation is willing to take.