Read with the right scope
Practical governance for UK organisations. FRC Code expectations apply to companies within its scope; the Orange Book is government guidance. Neither makes this workflow a universal legal requirement.
Status: Implementation guide · source-checked 1 November 2026
Begin with the decision
Risk appetite describes the risk an organisation is prepared to accept while pursuing its objectives. The FRC’s governance guidance places responsibility with the board and connects appetite to strategy, capacity, communication and review. It is a useful benchmark outside its formal scope, provided its status is made clear.
A statement such as ‘we have a low appetite for risk’ rarely helps the person approving a supplier, product or payment. Begin with the decisions that recur, the consequences that matter and the authority needed to accept exposure. Appetite does not permit a breach of law or override professional obligations.
Practical workflow: write limits people can apply
The following is an editorial implementation method, rather than a prescribed regulatory formula. Select a small number of risk themes that relate to your objectives. For each, describe the desired position, a measurable warning indicator and a point requiring an authorised decision. Explain the evidence needed when numbers are uncertain.
- Name the objective: for example, maintain dependable delivery to customers during supplier disruption.
- Describe exposure in ordinary language: overdependence on a provider, an untested recovery arrangement or unclear accountability.
- Define a decision trigger: for example, a critical service without an acceptable recovery test must be escalated before renewal.
- Assign an owner, approval authority, monitoring frequency and review event.
Keep exceptions visible
A temporary exception should identify the business reason, expected duration, compensating measures and person authorised to accept it. Record the residual exposure and the evidence supporting that judgement. Avoid silently raising a threshold because the organisation has already crossed it.
An illustrative decision record might say: ‘Renew for three months while a tested alternative is arranged; operations owner to report progress monthly; further extension requires board approval.’ This is an example of record structure, not a recommended threshold or assurance that a particular arrangement is acceptable.
Review with evidence
Compare incidents, near misses, overdue actions and operating results with the original appetite statement. Ask whether the limits influenced a real decision. If nobody can identify an example, the statement may need clearer triggers or better communication.
Keep the approved statement, its assumptions, decision history and exceptions together. Set a review when strategy, funding, services or regulation changes. The current Orange Book provides a public-sector risk-management reference; the GOV.UK collection records withdrawal of its older standalone risk-appetite note in July 2026, so avoid treating archived annexes as current guidance.
Put the guide to work
Start with the evidence.
- An approved statement linking each risk theme to an organisational objective.
- Defined warning indicators, decision thresholds and the person authorised to accept an exception.
- A recent decision showing how the limit changed an approval, condition or escalation.
- An exception log with reasons, temporary safeguards, expiry and review outcome.
Your first three steps
- Choose one recurring decision, such as renewing a critical supplier.
- Write the condition that requires escalation and identify the person who can decide.
- Apply the rule to a recent case and revise anything staff could not interpret.
Common gaps to look for
- ‘Low appetite’ with no usable decision trigger.
- Limits raised after a breach without a recorded decision.
- Temporary exceptions repeatedly extended without fresh evidence.
Review when: Revisit after a strategy change, a limit breach, an expired exception or evidence that a threshold did not influence decisions.
Suggested working method. Apply the source requirements and scope explained in this guide.
Part of the governance guidance hub. See how the GRC framework connects the disciplines.
Connect this to your review
Link the risk, control, obligation and next action in the review workspace. Record what is known, what needs checking and which decision follows. The workspace organises your records; it does not inspect or independently verify evidence.
Sources & verification
- FRC — Corporate Governance Code Guidance, risk appetite ↗Source checked 1 November 2026 · Primary source
- HM Treasury — current Orange Book collection and update history ↗Source checked 1 November 2026 · Primary source
The source list records when each reference was checked. AI-assisted research and drafting; no independent human legal review is claimed. Check for later changes and advice appropriate to your circumstances.