It is set by the board and translated into measurable risk limits (such as currency position, customer concentration and leverage). The risk appetite statement frames strategic decisions and the intensity of internal control.
Source: COSO ERM (2017), ISO 31000
Related terms
Enterprise risk management (ERM)The process of identifying, assessing, managing and monitoring, in an integrated way, the risks that could affect an organisation's achievement of its objectives.COSOThe organisation that publishes the most widely accepted frameworks for internal control and enterprise risk management, and the general name for those frameworks.Three lines modelA model allocating risk management and control responsibilities between business units (first line), risk management and compliance functions (second line) and internal audit (third line).Application controlsAutomated or IT-dependent manual controls embedded in a software application that ensure transactions are processed completely, accurately and with authorisation.Compliance auditAn examination of whether an organisation's activities are carried out in accordance with the relevant laws, regulations, contracts or internal rules.Compliance officerThe authorised person responsible for running the compliance programme for the prevention of money laundering and terrorist financing at an obliged entity.
Last updated: October 31, 2026 · This definition is for general information only.