Risk appetite: translating board intent into management decisions

Risk appetite is the level and type of risk an organisation is willing to accept in pursuit of its objectives.

For a South African board, setting it clearly is what turns high-level intent into disciplined day-to-day management decisions.

Board ownership and the statutory governance duty

Defining the organisation's risk appetite is a governance responsibility that sits with the board or accounting authority. Setting the boundaries of acceptable risk-taking gives executive leadership the mandate — and the limits — to pursue strategic outcomes while protecting the institution's assets and financial sustainability. For companies, the Companies Act 71 of 2008 establishes the board's duty to manage the company's affairs and direct its strategy.

In the public sector, the PFMA, as administered by National Treasury, places explicit fiduciary responsibility on the accounting officer or accounting authority to maintain an effective, efficient and transparent system of financial management, internal control and risk management, and the Auditor-General South Africa (AGSA) governance framework reinforces it, requiring leadership to ensure that risks are periodically identified, assessed and effectively mitigated. Setting risk appetite is therefore a core governance function — not an administrative task to be delegated wholesale to operational management — because it defines how the institution balances ambition against containment.

From intent to a risk-management strategy

Once the board sets its appetite, that intent has to be carried into the organisation through a formal framework. Under Treasury Regulation 27.2.1, a public entity must conduct regular risk assessments to identify emerging operational, financial and strategic risks, keeping leadership's picture of the risk environment current. The Treasury Regulations then require a documented risk-management strategy — including a fraud-prevention plan — that directs internal audit effort and priority and determines the skills managers and staff need to manage those risks. As the National Treasury Internal Audit Framework puts it, grounding the internal audit plan in that strategy focuses oversight on the areas of greatest exposure, so the board's appetite shapes where assurance effort actually goes.

Translating appetite into management decisions

Appetite earns its keep in daily decisions. The National Treasury Internal Audit Framework is explicit that management must determine the level of risk acceptable to the organisation in a given area before controls can be evaluated, and then design directive, preventive, detective and corrective controls to bring residual risk down to that acceptable level. With clear limits, management can prioritise the key exposures, concentrate supervisory attention on high-risk units, and keep operational choices aligned with strategy.

Working within set boundaries avoids two opposite failures — taking unvetted risks that threaten viability, or smothering low-risk routine activity in excessive control that slows service delivery. Line managers use the boundaries to route major commitments into rigorous evaluation while letting standard transactions proceed.

Under Treasury Regulation 27.2.1, a public entity must conduct regular risk assessments to identify emerging operational, financial and strategic risks, keeping leadership's picture of the risk environment current.

— Synthesis of South African regulatory guidance

Keeping actual risk-taking within appetite

A stated appetite means little without independent monitoring that actual risk-taking stays inside it. Under the National Treasury Internal Audit Framework, the internal audit activity provides assurance on the adequacy and effectiveness of the risk-management process — examining whether management's mitigation actually reduces exposure to acceptable levels — and reports its findings to the audit committee. The audit committee, under Treasury Regulation 27.1, reviews the organisation's risk-management framework, the risk areas to be covered in internal and external audit scopes, and the fraud-prevention plan.

The AGSA's external audit adds a further independent check, surfacing whether risk-management breakdowns have produced material misstatement, unreliable performance reporting or non-compliance — so that breaches of appetite reach the executive authority.

Governance habits that keep appetite live

Risk appetite goes stale unless the board keeps it active. Treasury Regulation 27.2.1 requires the risk-management strategy to be communicated to all employees, so that control expectations and risk boundaries are understood at every level and a risk-aware culture takes hold. Because the environment keeps shifting, management must run regular risk assessments to catch emerging risks before they become failures. And when internal audit or an AGSA management report shows exposure beyond the set boundaries or a failed control, management must put up an action plan with milestones and owners, which leadership and the audit committee monitor to completion — resolving the root cause rather than the symptom.

What good looks like

Good is an integrated model where board intent shapes daily decisions. The board under the Companies Act 71 of 2008, or the accounting authority under the PFMA, sets a clear risk appetite; the risk-management strategy, with its fraud-prevention plan, is communicated to all staff and directs internal audit priorities and skills, as the Treasury Regulations require; an adequately resourced internal audit activity tests whether risk management is working; and an empowered audit committee oversees coverage across internal and external audit. When findings or emerging risks reveal a control weakness, leadership acts through a monitored action plan to bring exposure back within appetite — connecting board intent to strategy, everyday choices and independent assurance, and protecting public resources on the way to a sustained clean audit.

Related insights

• Combined assurance: how an audit committee gains a coherent view of risk
• Internal audit and the audit committee: building assurance leaders can rely on
• Internal controls: connecting design, ownership and reliable operations