What is a risk appetite statement and why is it important in governance?

• A. It defines the level and type of risk the organization is willing to accept to achieve objectives; it guides decisions and risk responses.
• B. It is a legal requirement requiring external reporting of risks.
• C. It lists all possible risks that could occur.
• D. It describes the organization's financial budget.

Answer: (A)

Risk appetite statements set the level and type of risk an organization is willing to accept in pursuit of its objectives, and they anchor governance by guiding decisions and risk responses. They translate strategy into actionable guardrails, so executives and the board can assess whether a proposed initiative or action fits within acceptable risk boundaries. This helps with prioritizing investments, approving projects, and shaping how risks are mitigated, tolerated, or transferred. It also provides a common language for monitoring, reporting, and escalation, ensuring that the organization stays aligned with its aims while maintaining accountability and consistency across units.

They’re not a legal requirement for external risk reporting, nor a list of all possible risks, nor a description of the financial budget, which is why those options don’t fit.