Risk appetite statements
A risk appetite statement says how much risk of one category a company is willing to take. In ERM Core each statement is linked to the KRIs that measure it, so the board’s words and the indicators’ thresholds say the same thing.
Who may do it: the Group RM drafts the group root’s statements; the Entity Risk Manager drafts their own entity’s. See Roles and permissions.
What a statement carries
Section titled “What a statement carries”| Field | What it holds |
|---|---|
| Risk category | One of the 8 standard categories |
| Statement | The appetite, in words — what the company accepts and what it does not |
| Linked KRIs | The indicators that measure it; their Amber and Red bands express the appetite in numbers — see Thresholds |
| Approval | Who approved it and when |
| Version | The version number and the date from which it applies |
Writing and approving a statement
Section titled “Writing and approving a statement”- Open the risk appetite statements of your entity.
- Choose the risk category and write the statement.
- Link the KRIs that measure it.
- Submit it for approval. The approval is recorded for the entity’s own board or RMC, with who approved and when.
- Once approved, the statement becomes the current version; the previous version stays in its history.
What the system does or refuses
Section titled “What the system does or refuses”- One current statement per category per entity.
- Every approval creates a version; earlier versions are kept and do not change.
- Each entity owns its own appetite. A parent reads a subsidiary’s statements and cannot write or approve them — see Subsidiary-Independence.
- Who drafted and who approved are stamped — see Who-filed is stamped.