Beyond Tolerance Statements: Building Board-Level Risk Governance That Holds

## The Gap Between Statement and Substance

Risk appetite has become a standard fixture of board documentation. Audit and risk committees routinely approve multi-page frameworks that define tolerance thresholds, escalation triggers, and heat maps. Yet when regulators, institutional investors, or post-crisis reviews examine how boards actually governed risk in the periods preceding material failures — at Silicon Valley Bank, at Credit Suisse, at AMP in Australia — a consistent pattern emerges: the framework existed; the governance did not.

The distinction matters enormously. A risk appetite statement is a document. Risk governance is a system of behaviour, information flow, accountability, and challenge that shapes how decisions are made under uncertainty. Boards that conflate the two are, in effect, governing on paper.

The OECD Principles of Corporate Governance (2023 revision) are explicit on this point: the board's risk oversight function requires not merely the approval of policies but active engagement with "the nature and level of the risks a company is willing to take in pursuit of its objectives," linked directly to strategy. That linkage — between appetite and strategic choice — is where most boards remain underdeveloped.

## What Rigorous Risk Appetite Actually Requires

Effective board-level risk governance rests on four interconnected requirements that go well beyond the drafting of tolerance statements.

**Appetite must be expressed in decision-relevant terms.** Statements that describe risk appetite as "moderate" or "conservative" provide no operational guidance. The Australian Institute of Company Directors (AICD) has long maintained that appetite frameworks should specify quantitative boundaries — revenue at risk, capital thresholds, reputational exposure metrics — tied to specific risk categories. A board approving a major acquisition, a new market entry, or a technology transformation should be able to test that decision against a stated boundary, not an adjective.

**The information architecture must support genuine oversight.** Research published through the Harvard Law School Forum on Corporate Governance consistently identifies information asymmetry as a primary driver of board risk failures. Directors receive what management curates. Robust risk governance requires boards to specify the information they need independently of what management volunteers — including leading indicators, near-miss data, and external benchmarks. Some leading boards now commission direct reporting lines from the Chief Risk Officer to the board chair or risk committee, bypassing the CEO filter for material risk matters.

**Risk culture must be assessed, not assumed.** INSEAD governance research has documented the degree to which stated risk appetite diverges from revealed risk appetite — the appetite implicit in actual decisions, incentive structures, and the treatment of dissenters. Boards that rely solely on management attestation to assess risk culture are operating blind. Independent culture diagnostics, whistleblower data analysis, and structured board interviews with mid-level risk and compliance staff are among the more rigorous methods now being deployed.

**Board composition must include genuine risk competence.** Hogan Assessments research on executive and director personality profiles identifies a persistent pattern: boards with high average learning agility and low defensiveness demonstrate significantly more effective challenge behaviour in risk discussions. Credentials alone — a background in finance or audit — do not produce effective risk governance. The ability to ask probing, uncomfortable questions in a collegial setting is a distinct capability that board assessments should evaluate and that director selection processes should weight accordingly.

## The Stress-Testing Imperative

One of the most underused tools in board-level risk governance is the structured stress test applied to the board's own decision-making process — not to the balance sheet, but to the governance itself.

This involves asking: under what conditions would our risk appetite framework fail to constrain a poor decision? What management pressures, time constraints, information gaps, or group dynamics would cause this board to approve something it should not? The answers are rarely comfortable, which is precisely why most boards avoid the exercise.

Scenario-based governance reviews, facilitated by an independent party and structured around realistic adverse conditions, allow boards to identify structural vulnerabilities before they are exposed by events. This practice, increasingly common among FTSE 100 and ASX 200 boards undertaking formal effectiveness reviews, produces more durable governance than any policy update.

## Accountability Structures That Endure

Risk governance architecture requires clarity about who is accountable for what. The "three lines" model — operational management, risk and compliance functions, and internal audit — remains the dominant framework, but its effectiveness depends entirely on how boards engage with each line.

Boards that treat internal audit as a compliance box rather than a strategic intelligence function consistently miss early warning signals. Effective risk committees meet separately with internal audit leadership, without management present, at least once per year. They also review the resourcing and independence of the risk function as a governance matter, not a management one.

Director accountability must also be personally owned. Diffusing risk oversight to a subcommittee and treating the full board as a ratifying body creates dangerous gaps. The full board retains responsibility for understanding the organisation's material risks. Committee structures should improve the depth of analysis, not dilute the accountability of individual directors.

## A Practical Agenda for Boards in 2025

Several concrete steps separate boards that govern risk rigorously from those that govern it nominally.

- Commission an independent review of whether the current risk appetite framework is expressed in decision-relevant, quantitative terms — and whether it is actually referenced in board papers accompanying major decisions. - Redesign the information flow from the risk function to the board, specifying what leading indicators, culture signals, and external benchmarks directors require. - Incorporate a risk culture assessment into the next board effectiveness review, using independent diagnostic methods rather than management self-assessment. - Evaluate risk competence — not just credentials — in the next director recruitment or succession process. - Schedule a structured stress test of the board's own governance processes against at least two plausible adverse scenarios in the coming twelve months.

Risk governance that holds under pressure is not built from better documentation. It is built from clearer accountabilities, more honest information, more rigorous challenge, and a board that understands the difference between approving a framework and owning the outcome.