Risk Management Strategy

A risk management strategy that describes process without stating appetite leaves the hardest question unanswered.

Appetite is how much risk the organisation is willing to accept in pursuit of its objectives, and it varies by category. An organisation may accept meaningful financial risk and almost none on worker safety, and saying so out loud is what makes it usable.

Tolerance is the narrower limit. The point at which a risk stops being acceptable and something has to happen.

Without both, every decision is argued from first principles by whoever is in the room, and outcomes vary by personality rather than by policy.

Write the appetite out by category, in plain words rather than in ranges, and state clearly who is able to accept a risk at each level.

ASIC publishes governance guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s GRC system and risk management system.