Free risk appetite statement template.

What is a risk appetite statement?

A risk appetite statement sets out, in advance, how much risk your organisation is willing to take in pursuit of its objectives — and where the line is. It turns "we should be careful about cyber" into something measurable: an appetite level, a tolerance threshold, the metric you'll watch, and what happens when it's breached. In COSO ERM 2017 terms, it's the bridge between strategy & objective-setting and day-to-day risk decisions.

What's inside the template

• Per-category rows for your COSO-aligned risk categories.
• Appetite level drop-down: Averse → Minimal → Cautious → Open → Hungry.
• Appetite statement — a plain-language sentence per category.
• Tolerance threshold — the measurable boundary you won't cross.
• Key metric / KRI and escalation trigger — what you monitor and when to escalate.
• Owner — who is accountable.
• Five worked examples (cyber, financial, compliance, strategic, operational) to show the pattern.

How to write yours

1. Start from your objectives — appetite only means something relative to what you're trying to achieve.
2. For each category, choose an appetite level and write one clear sentence.
3. Make it measurable: attach a tolerance threshold and a metric or KRI.
4. Define the escalation trigger and the owner.
5. Get it approved by the board or risk committee, and review it at least annually.

Once approved, connect it to your live data. In Rukn ERM, appetite and tolerance are set per category and breaches surface automatically as risks move — no manual checking.