Who sets risk policy and appetite in a typical risk governance structure?

Who sets risk policy and appetite in a typical risk governance structure?

• A. The management team.
• B. The board.
• C. The risk committee.
• D. Internal audit.

Answer: (B)

Setting risk policy and appetite is a board-level responsibility because these decisions shape how the organisation approaches risk in line with its strategy, capital, and stakeholder expectations. The board approves the risk appetite statement, which defines the level and types of risk the organisation is prepared to accept, and it signs off the risk policy that establishes the governance framework, roles, and controls for managing risk. Once this overarching framework is set, management translates it into day-to-day risk limits, procedures, and reporting, ensuring operations stay within the approved boundaries. The risk committee can provide focused oversight and challenge on behalf of the board, but it does not independently determine policy or appetite. Internal audit, meanwhile, offers independent assurance that policies are being followed and controls are effective, rather than setting them.

Setting risk policy and appetite is a board-level responsibility because these decisions shape how the organisation approaches risk in line with its strategy, capital, and stakeholder expectations. The board approves the risk appetite statement, which defines the level and types of risk the organisation is prepared to accept, and it signs off the risk policy that establishes the governance framework, roles, and controls for managing risk. Once this overarching framework is set, management translates it into day-to-day risk limits, procedures, and reporting, ensuring operations stay within the approved boundaries. The risk committee can provide focused oversight and challenge on behalf of the board, but it does not independently determine policy or appetite. Internal audit, meanwhile, offers independent assurance that policies are being followed and controls are effective, rather than setting them.