Risk Appetite Statement Template – Free Word Download
Introduction to Risk Appetite
In the world of project management, we often focus intensely on identifying risks (Template 16) and managing risks (Template 17). However, we rarely pause to ask the fundamental question: How much risk are we willing to take?
This omission is a significant source of conflict. Imagine a Project Manager who believes that “time is money” and therefore decides to skip a round of testing to meet the deadline. Now imagine a Project Sponsor who believes that “reputation is everything” and would rather be late than release a buggy product. Neither person is objectively wrong; they simply have different Risk Appetites.
The Risk Appetite Statement is the strategic compass that aligns these perspectives. It is a formal declaration by the organization (or the Project Board) that defines the boundaries of acceptable risk. It tells the Project Manager where they can run fast and where they must tread carefully. It creates a “Safe Harbor” for decision-making. If the Project Manager takes a calculated risk that falls within the agreed appetite, they are protected from blame if things go wrong. Conversely, if they take a risk that exceeds the appetite, they are acting without authority.
This template helps you articulate these boundaries. It breaks down risk appetite into specific categories (Financial, Reputational, Operational, etc.) because an organization rarely has a single appetite. A company might be “Risk Hungry” regarding Innovation but “Risk Averse” regarding Safety. This document captures those nuances.
Section 1: Definitions and Concepts
Guidance for Completion
Before you can agree on the appetite, you must agree on the vocabulary. Risk terminology is often used interchangeably, which causes confusion. You must define three specific concepts for your stakeholders to ensure everyone is having the same conversation.
Getty Images
Risk Tolerance is the accepted deviation from Risk Appetite
The Three Critical Terms
- Risk Appetite (The Desire): The amount of risk the organization is willing to accept in pursuit of value. This is a broad, strategic statement. (e.g., “We are willing to take high risks to be first to market”).
- Risk Tolerance (The Variance): The specific, measurable deviation from the plan that is acceptable. (e.g., “We will accept a budget overrun of 10%, but not 11%”).
- Risk Capacity (The Ability): The maximum amount of risk the organization can bear before it collapses or goes bankrupt. You must never set your appetite higher than your capacity.
Draft Example
“Concept: Driving a Car.
- Risk Appetite: The speed I want to drive to get to the meeting on time (e.g., 80 mph).
- Risk Tolerance: The variance I accept above the speed limit before I fear a ticket (e.g., +5 mph).
- Risk Capacity: The maximum speed the engine can handle before it explodes (e.g., 140 mph).Governance Rule: We shall never set an appetite (80 mph) that exceeds our capacity (140 mph).”
Section 2: The Appetite Scale (Levels 1-5)
Guidance for Completion
To make this document useful, you need a grading system. Using vague words like “High” or “Low” is insufficient. You should use a standardized 5-point scale. This allows you to rate different categories of risk against a consistent rubric.
The Standard Scale Definitions
- Averse (1): Avoidance of risk and uncertainty is a key objective. We prefer safe options that offer low returns. We have a preference for proven, established technology and processes. Target: Zero Risk.
- Minimalist (2): We are willing to accept some minor risks, but only where they are unavoidable. We prioritize safety and security over potential gains. Target: Very Low Risk.
- Cautious (3): We are willing to accept moderate risks, but we prefer safer options. We will take risks only if the potential benefits clearly outweigh the threats. Target: Balanced Risk.
- Open (4): We are willing to consider all options and choose the one that is most likely to result in successful delivery, even if it carries elevated risk. We accept that things might go wrong and have contingency funds ready. Target: High Reward.
- Hungry / Seeking (5): We are eager to be innovative and to choose options offering higher business rewards, despite greater inherent risk. We accept failure as a possible outcome of innovation. Target: Maximum Disruption.
Draft Example for Context
“For this project, we define our scale as follows:
- Averse: We will pay a premium to remove the risk (e.g., Insurance).
- Seeking: We will not pay to mitigate the risk; we will ‘roll the dice’ to save money.”
Section 3: Overall Project Appetite Statement
Guidance for Completion
This is the executive summary. It sets the general tone for the project. Is this a “Moonshot” project where failure is an option? Or is this a “Compliance” project where failure is illegal?
Drafting the Narrative
Combine the strategic importance of the project with the organization’s culture.
Draft Example
“Project: Next-Gen AI Customer Support.
Overall Appetite: Open (Level 4).
Narrative: This project is a strategic initiative to disrupt the market. The Board acknowledges that AI technology is new and carries inherent technical risks. Therefore, the organization adopts an Open appetite. We are willing to accept technical instability and model inaccuracies in the short term in exchange for speed to market. We prioritize ‘Learning’ over ‘Perfection.’ However, we remain Averse to any risk that compromises customer data privacy.”
Section 4: Financial Risk Appetite
Guidance for Completion
This section deals with money. Specifically, it deals with the willingness to lose money or overspend.
Distinctions to Make
- CAPEX (Capital Expenditure): Building the asset.
- OPEX (Operational Expenditure): Running the asset.
- ROI (Return on Investment): The uncertainty of the payback.
Questions to Ask the Sponsor
- If we need to spend an extra $50k to hit the deadline, should we do it? (If yes, appetite is Open).
- If the project fails, can the company absorb the loss of the entire budget? (Capacity check).
Draft Example
- Category: Financial.
- Appetite Level: Cautious (3).
- Statement: “We are willing to accept moderate variance in the project budget (+/- 10%) to ensure quality. However, we are Averse to any scenario that creates a long-term OPEX liability greater than $10,000 per month. The project must not commit the company to expensive recurring contracts without Board approval.”
- Tolerance Limit: Any single change request exceeding $20,000 must be escalated.
Section 5: Strategic and Innovation Appetite
Guidance for Completion
This relates to the “Scope” and the “Product.” How much failure can we tolerate in the functionality?
The “Failure” Spectrum
- Averse: The product must be perfect (e.g., A Pacemaker).
- Hungry: The product can be buggy if it is cool (e.g., A Beta Video Game).
Draft Example
- Category: Innovation / Technology.
- Appetite Level: Hungry (5).
- Statement: “To achieve our goal of market leadership, we must use cutting-edge, unproven technology. We acknowledge that this may result in rework or wasted development cycles. We explicitly accept the risk that 30% of our developed features may be discarded if they fail user testing. We value ‘Innovation’ over ‘Efficiency’ for this specific initiative.”
Section 6: Operational and Safety Appetite
Guidance for Completion
This is usually the most restrictive category. Very few organizations are “Hungry” for safety risks. This section often contains “Zero Tolerance” statements.
Areas to Cover
- Health & Safety (H&S): Physical harm to people.
- Business Continuity: Keeping the lights on.
- Service Levels: Uptime.
Draft Example
- Category: Health, Safety, and Wellbeing.
- Appetite Level: Averse (1).
- Statement: “The organization has a zero-tolerance policy for risks that endanger the physical safety or mental well-being of our staff or customers. No schedule pressure or budget constraint justifies compromising safety protocols. If a safety risk is identified, work must stop immediately.”
Section 7: Legal and Compliance Appetite
Guidance for Completion
Can we break the law? Usually, the answer is “No.” However, there is nuance in interpretation.
The “Grey Area”
- Averse: We follow the letter of the law and the spirit of the law. We do not operate in grey areas.
- Cautious: We follow the letter of the law. We will operate in a grey area if we have a strong legal opinion supporting us.
- Open: We will push the boundaries of regulation to disrupt the industry (e.g., Uber or Airbnb in their early days). Warning: This is dangerous.
Draft Example
- Category: Regulatory Compliance (GDPR).
- Appetite Level: Averse (1).
- Statement: “We will not accept any risk that puts the organization in breach of Data Privacy laws. We will implement ‘Privacy by Design’ regardless of the impact on project speed. We require 100% compliance with all statutory reporting requirements.”
Section 8: Reputational Appetite
Guidance for Completion
How much bad press can you handle? This is subjective but vital.
The “Front Page” Test
Ask the Sponsor: “If this risk materialized and ended up on the front page of the newspaper, could we survive it?”
Draft Example
- Category: Reputation and Brand.
- Appetite Level: Minimalist (2).
- Statement: “We prioritize our brand reputation as a ‘Trusted Partner.’ We avoid risks that could lead to public embarrassment or loss of customer trust. However, we accept that minor negative feedback on social media is inevitable when launching a new product. We will monitor sentiment but will not halt the project for isolated complaints.”
Section 9: The Risk Appetite Matrix (Visual Summary)
Guidance for Completion
A visual grid helps stakeholders see the profile at a glance. It often reveals contradictions (e.g., trying to be “Hungry” on Innovation but “Averse” on Finance).
Shutterstock
Draft Table Representation
| Risk Category | Averse (1) | Minimalist (2) | Cautious (3) | Open (4) | Hungry (5) |
| Financial | X | ||||
| Innovation | X | ||||
| Safety | X | ||||
| Legal | X | ||||
| Reputation | X | ||||
| Schedule | X |
Analysis of the Matrix
“The matrix above shows a ‘Bimodal’ appetite. We are aggressive on Schedule and Innovation but defensive on Safety and Legal. This means the Project Manager is authorized to cut corners on scope to go faster (Open), but is not authorized to cut corners on safety compliance (Averse).”
Section 10: Governance and Escalation Triggers
Guidance for Completion
What happens when the risk exceeds the appetite? You need a mechanical rule. This prevents the Project Manager from sitting on a “Red” risk that violates the company’s tolerance.
The Escalation Rule
“If the Current Risk Score > Appetite Limit, then Escalate.”
Draft Example
Governance Protocol:
- Within Appetite: If a risk falls within the defined appetite (e.g., a Financial Risk scored as ‘Low’ or ‘Medium’), the Project Manager is authorized to manage it using the project contingency budget without seeking external approval.
- Exceeding Appetite: If a risk exceeds the appetite (e.g., a Safety Risk scored as ‘Medium’ or ‘High’ when the appetite is ‘Averse’), the Project Manager must effectively treat it as an Issue. It must be escalated to the Steering Committee within 24 hours with a request for direction.
Section 11: Application to Vendor Management
Guidance for Completion
Your vendors might have a different appetite than you. If you are “Averse” and they are “Hungry,” you have a problem. You must impose your appetite on them via the contract.
The “Flow Down” Principle
State clearly that the project’s risk appetite applies to all suppliers.
Draft Example
“Vendor Alignment: All vendors responding to the RFP must demonstrate alignment with our ‘Averse’ appetite regarding Cybersecurity. Vendors must prove they have ISO 27001 certification. We will not accept a vendor who proposes to ‘move fast and fix security later.'”
Section 12: Capacity Analysis (The Reality Check)
Guidance for Completion
Just because you want to take a risk (Appetite) doesn’t mean you can (Capacity). This section creates a safety buffer.
Capacity Statements
- Financial Capacity: “We have a cash reserve of $1M. We cannot take risks that threaten more than 50% of this reserve.”
- Resource Capacity: “We have 10 developers. We cannot take risks that might require 20 developers to fix.”
Draft Example
“Capacity Warning: While our appetite for Innovation is ‘Hungry,’ our Resource Capacity is currently constrained due to the hiring freeze. Therefore, we effectively cap our Innovation Appetite at ‘Cautious’ until the freeze is lifted. We simply do not have the bodies to fix things if a high-risk experiment fails.”
Section 13: Review and Modification Cycle
Guidance for Completion
Appetite changes over time. In the beginning (Startup phase), you might be Hungry. Near the end (Operational phase), you might become Averse.
The Review Trigger
State when this document will be reviewed.
Draft Example
“This Risk Appetite Statement is valid for the ‘Initiation and Planning’ phases. It will be formally reviewed at Gate 3 (Execution Readiness). It is anticipated that the appetite for Technical Risk will shift from ‘Open’ to ‘Minimalist’ once the system goes live to protect actual customers.”
Section 14: Sign-Off and Board Authorization
Guidance for Completion
This is the most critical signature in the project. By signing this, the Sponsor is giving the Project Manager “Permission to Fail” within the agreed boundaries.
The “Safe Harbor” Clause
Include a statement that protects the PM.
Signature Block
- Project Sponsor: ___________________
- Date: ___________________
- Statement: “I confirm that this document represents the Risk Appetite of the organization for this specific initiative. I authorize the Project Manager to make decisions and take risks that fall within these defined boundaries. I understand that taking these risks may result in issues, and I accept accountability for those potential outcomes provided the governance process was followed.”
Detailed Tips for Negotiating Risk Appetite
Tip 1: The “Coin Toss” Scenario
If a stakeholder struggles to define their appetite, use this scenario:
“Would you bet the entire project budget on a coin toss if the reward was doubling the budget?”
- If they say “No,” they are not Hungry.
- If they say “Yes,” they are insane (or very Hungry).
- If they say “I’d bet 10%,” they are Cautious.
Tip 2: Beware of “Zero Risk”
Stakeholders will often say, “I want zero risk.”
- Your Response: “Zero risk means zero activity. Staying in bed is the only way to have zero risk (and even then, the roof might fall). We need to define acceptable risk, not zero risk.”
Tip 3: Distinguish between “Outcome” and “Method”
A stakeholder might be Averse to the Outcome (Project Failure) but Open to the Method (Agile/Iterative). Clarify this distinction. “We are taking risks on the method precisely to reduce the risk of the outcome.”
Common Pitfalls to Avoid
Pitfall 1: The “Cookie Cutter” Statement
Do not just copy the corporate risk policy. Corporate policies are usually generic and “Averse.” Projects are often change agents that need to take more risk than the steady-state corporation. You must fight for a project-specific appetite.
Pitfall 2: Silent Disagreement
If the CFO is Averse and the CTO is Hungry, and you settle on “Cautious” without them talking, you will fail. They will both act according to their own nature. You must force the debate until they agree on the written word.
Pitfall 3: Ignoring the “Risk of Inaction”
Sometimes, not taking a risk is the riskiest path.
- Example: “If we are ‘Averse’ to using the new AI tool, we risk our competitor using it and putting us out of business.”
- Correction: Add a section on “Opportunity Cost” to balance the view.
Conclusion
The Risk Appetite Statement is the “Rules of Engagement” for your project. It answers the question “How brave can we be?”
Without this document, the Project Manager is in a precarious position. They are forced to guess the risk tolerance of their superiors. If they guess right, they get no credit. If they guess wrong, they get fired.
By completing this template, you shift the burden of risk definition from the individual Project Manager to the governance board, where it belongs. You create a shared mental model of what “Safe” and “Dangerous” mean.
Remember that an “Averse” appetite is expensive (checks, double-checks, insurance), while a “Hungry” appetite is volatile (speed, breakage, redo). There is no “right” appetite, only the one that fits your specific business case. Use this document to find that fit and secure the mandate to execute with confidence.
Meta Description
A template for the Risk Appetite Statement. Defines the organization’s willingness to accept risk across financial, operational, and reputational categories using a 1-5 scale.