One of the more difficult aspects of establishing a risk management framework is the quantification of risk appetite. It must reflect an organisation’s operating environment and support strategic decision-making.
Obtaining input, consensus and buy-in from senior leadership level is particularly challenging. Risk appetite can be notoriously tricky to define; so is achieving consensus and embedding principles across complex organisations.
In ALARM’s new guide, The principles of risk appetite, ALARM member Tereza Fairbairn’s experience at Babergh and Mid Suffolk District Councils reflects a meticulous and inclusive approach – right from the start. As she says in the Guide: "We used the insight and knowledge of senior leadership and our strategic policy team to input into the draft… In the second phase our cabinets were invited for input…"
When I spoke to Tereza, Risk Management Lead at the Council, she explained the importance of early input and ultimate buy-in: “Getting input from senior leaders was essential because their strategic perspective ensured the risk appetite statement aligned with the Councils' strategic priorities. Their involvement also fostered ownership, making it more likely the statement would be embedded in decision-making.”
For Tereza, who manages risk for two councils, it was always going to be complex, so she used tried and tested methods to navigate the exercise. “We aligned our statement to the 13 HM Government Orange Book risk types, each with its own nuance, and developed a joint statement for two councils with differing perspectives”.
Regardless of the complexity, Tereza asserts it is essential to work with senior leaders, engaging and educating them on risk appetite: “It is important that boards (and/or cabinets) understand that to achieve their strategic objectives, they may have to adopt a more assertive risk appetite, recognising that risk appetite should be forward-looking”.
But despite the time, the complexity and the challenges, Tereza believes it was worth agreeing their risk appetite statement. “The statement clarified our strategic approach to risk and supports consistent decision-making.” She is certain it will contribute to a more confident and informed risk culture across the organisation.
Chris Walker, ALARM President says:
“Tereza’s approach shows the benefits of working with a wide range of stakeholders when developing a risk appetite statement. By adopting a consultative approach, Babergh and Mid Suffolk District Councils engendered a high degree of ownership and understanding, which helped break down some of the complexity associated with the concept of risk appetite.”
Tereza’s top tips on getting a board on board with risk appetite:
- Give them a process, structure and timelines.
We approached the task as a formal project. We started by setting clear objectives and timelines, then brought together a working group from each of our two cabinets to guide the process. Our structure helped us stay focussed and deliver a statement that was both strategic and practical.
- Give everyone involved a defined job.
Having clearly documented roles and responsibilities helped us engage the right stakeholders and secure buy-in.
- Don’t reinvent the wheel.
We’d recommend anchoring the risk appetite process to your existing risk framework and classification model.
- Get senior leaders involved from the start.
Early senior leadership involvement was key. It set the tone, aligned expectations and built ownership, making it easier to secure consensus and embed the risk appetite across the organisation.
- Be inclusive - gather input from a range of stakeholders via various settings.
We used workshops and iterative drafts to gather input — especially from senior leaders and Cabinet members — and kept everything on track with regular check-ins.
- Educate stakeholders.
Spending time with the working groups to deepen understanding of risk appetite helped us navigate the challenges. Education has been key, with more sessions planned to embed the risk appetite statement across both councils.
- Don’t be afraid to experiment and evolve.
We gave ourselves permission to test and refine the statement over time, recognising that risk appetite evolves with the changing external and internal organisational context.
Read Tereza’s case study, along with other ALARM risk practitioner members’ case studies, in ALARM’s latest guide, The principles of risk appetite. It is available to all ALARM members and partners now.
The principles of risk appetite is the first in a new series: The Practitioners’ View. It has been planned and produced with contributions from 22 ALARM members who share their learnings and expertise, as well as case studies and best practice.
This peer led guide provides the template for a suite of new guidance documents under the Practitioners Guide banner. Work begins in January 2026 on a new guide focussing on the development of key risk Indicators. If you would like to contribute to this guide, please contact the ALARM Office.
