What is the relationship between governance and risk appetite?

• A. Governance sets risk appetite and provides oversight; risk management identifies, assesses, mitigates, and monitors risks and informs governance decisions.
• B. Risk appetite is defined exclusively by the board; governance has no role.
• C. Governance should ignore risk appetite in decision making.
• D. Risk appetite is fixed and never informs governance decisions.

Answer: (A)

At the heart of this relationship is that governance sets the level of risk the organization is willing to take and provides ongoing oversight, while risk management works within that framework to identify, assess, mitigate, and monitor risks and to bring timely information back to governance for informed decisions. This alignment ensures that the organization pursues its objectives without taking on more risk than it has agreed to accept, and it allows governance to adjust strategy, policies, and resource allocation based on what risk management reveals.

The board or governing body typically approves the overall risk appetite and risk governance structure, but risk management is essential for translating that appetite into concrete actions—identifying where risks lie, evaluating their potential impact, implementing controls or mitigations, and tracking residual risk. When risk information indicates risks are drifting beyond accepted levels, governance can respond by adjusting priorities, resources, or risk tolerances.

Choosing options that say risk appetite is defined exclusively by the board, that governance should ignore risk appetite, or that risk appetite is fixed and never informs governance decisions misses how governance and risk management interact in practice. Risk appetite is a dynamic element that should guide decisions and be updated as strategy, conditions, or performance change, ensuring governance remains aligned with the organization’s objectives.