A risk appetite statement should change the next decision

A risk appetite statement becomes useful when it changes how a proposal is assessed, approved or escalated. Describing an organisation as having a low appetite for disruption gives a direction; managers still need to know which evidence to bring, which choices remain available and who decides when a proposal crosses the boundary.

For Malaysian listed-company boards, the Malaysian Code on Corporate Governance provides relevant context. Its G1.1 guidance places risk appetite within board oversight and connects it to a framework for managing significant financial and non-financial risks. The Code is primarily aimed at listed companies; other organisations are encouraged to adopt its practices. This article’s decision method is an original management approach, not a prescribed Malaysian threshold or a substitute for applicable legal and sector requirements. 1

A useful statement should help two managers reach a consistent recommendation when presented with the same facts. That does not require a number for every risk. It does require a clear connection between the objective, the exposure the organisation is willing to take, the evidence used to assess it and the decision authority.

The practical takeaways are to test appetite against real decisions, define escalation before a boundary is crossed and preserve the reason for a choice. A green dashboard alone cannot establish that management acted within the intended appetite.

Choose one recurring proposal: expanding a delivery promise, entering a new market or concentrating work with a supplier. Ask the business owner what objective the proposal advances and what credible failure would threaten that objective. Keep that description specific enough for the approving group to challenge.

Then compare the appetite statement with the evidence normally supplied. A statement about service resilience will be difficult to apply if the proposal contains only revenue and price. The missing information might concern recovery arrangements, dependence on one operating location or the ability to reverse the decision. Select evidence for the exposure; avoid adding measurements merely because they are easy to count.

Use a short record such as the following. These are suggested management fields, not Code wording.

Keep the boundary understandable without a separate scoring manual. Where a numerical limit is justified, record its units, population, period and rationale. Where judgement is necessary, describe the considerations and authority. An unexplained score can hide disagreement about the actual consequence.

Imagine a fictional Malaysian distributor considering a faster delivery promise. Its board has expressed a low appetite for extended service interruption. The proposed operating rule requires the approving manager to see evidence that the promised service can continue when its principal dispatch arrangement is unavailable. This condition is invented for illustration; it is not an industry benchmark.

In the first proposal, the team supplies a current, relevant exercise record and explains its limitations. The decision maker can assess whether those limitations fit the agreed appetite. In the second, the alternative dispatch arrangement exists only in a plan and has never been exercised. The same headline business benefit now rests on materially different evidence.

The rule should make that difference visible. It might lead to a narrower promise, additional preparation or escalation through the organisation’s authority framework. It does not automatically establish that either proposal is safe, lawful or commercially sensible. Those conclusions require the actual evidence and competent judgement.

Fictional management record. Consider a distributor whose proposed expanded delivery promise requires a fallback of 80 priority orders per day. The figure is invented for this proposal, not a Malaysian Code requirement.

In Scenario A the apparent margin is 12.5% of the required minimum: (90 − 80) ÷ 80 × 100. That margin says nothing about a missing carrier, peak demand, safety or the permitted scope. In Scenario B identical arithmetic cannot repair a weaker evidence basis.

The decision record therefore includes an evidence condition as well as a capacity figure. The authorised group may seek a different service commitment or further preparation; any particular approval depends on the actual appetite, obligations and evidence. These are invented inputs and decision alternatives, not a claim that QSE tested a distributor or that the proposed threshold is optimal.

An appetite statement guides a class of decisions. An individual risk acceptance records an authorised response to a particular exposure, with its own conditions and review point. The linked article uses a US context; its record-control ideas do not establish Malaysian legal duties.

If exceptions repeatedly cross the same appetite boundary, bring that pattern back to the responsible leadership group. The organisation may need different resources, a changed business proposal or a deliberate reconsideration of appetite. Repeated exceptions should not silently rewrite the statement. An internal approval also cannot make a prohibited activity permissible.

Select a small set of recent decisions on both sides of a boundary. Ask whether the evidence supported the recommendation, the correct authority decided and the outcome was monitored. Include a case where information was incomplete. This is a proposed management check, not an assurance opinion on the entire framework.

Where reviewers disagree, record the ambiguity and improve the wording or evidence requirement. The most useful revision may be a clearer escalation instruction rather than a more elaborate heat map. Retain the earlier statement and explain which future decisions the revision affects.

AI assisted research and drafting. The example is hypothetical. Obtain competent review of consequential risk, legal and sector-specific decisions.

1. Securities Commission Malaysia, Malaysian Code on Corporate Governance — updated 28 April 2021; scope and G1.1, printed page 18. Source checked 9 October 2026. Practical records and examples above are editorial suggestions.

This article is general information. Verify current requirements and seek qualified advice for your specific circumstances.

Spotted an issue? Contact our editorial desk.