Image: Istock
Risk appetite
Setting clear boundaries for strategic decision-making
RISK & ASSURANCE
Chris Mansfield
Associate, Campbell Tickell
Sue Harvey
Director, Campbell Tickell
Issue 85 | September 2026
A risk appetite statement sets out the level of risk an organisation is willing to accept as it works to deliver its strategic objectives. It is a key board tool for setting risk culture, communicating the organisation’s broad attitude to risk to stakeholders and giving the executive team clear authority to manage day-to-day business within agreed boundaries.
Setting risk appetite is also required or encouraged by many governance codes relevant to the sector, including the NHF Code of Governance, the British Property Federation’s Code of Governance for For-Profit Registered Providers and the FRC’s guidance on the UK Corporate Governance Code.
At a time when housing associations’ financial capacity has reduced significantly, and government expects the sector to deliver a step change in new supply, clear risk appetite gives boards a practical way to balance ambition with financial resilience. Drawing on our work with boards, this article sets out a practical approach to determining and embedding risk appetite.
Select risk categories
The first step is to determine which risk categories should be included. For each category, the statement should set clear, high-level boundaries within which the executive team can operate. This gives them confidence to make timely decisions while ensuring the board remains clear about the level and type of risk it is prepared to accept.
Financial risk appetite is usually a core category. Others typically include:
- principal business activities where risk limits need to be clearly understood, such as development and asset management
- areas of potential growth, or activities the organisation is considering withdrawing from, where risk appetite can support strategic debate
- key legal and regulatory requirements, including landlord health and safety, where the board needs robust assurance.
“Clear risk appetite gives boards a practical way to balance ambition with financial resilience.”
Determine appetite
Once the categories have been agreed, the statement should express the board’s collective appetite for each one, usually using a five-point scale such as: averse, minimal, balanced, open and hungry or seeking. Narrative definitions for each level help members articulate where they believe the board’s appetite should sit.
Financial risk appetite usually involves setting limits against key metrics, including loan covenant headroom, minimum liquidity requirements and maximum exposure to higher-risk activities such as building homes for sale.
These ‘golden rules’ set clear limits on the level and type of risk that can be taken when building budgets, cashflow forecasts and long-term financial plans. They also provide a robust basis for decisions and trade-offs, such as balancing development ambitions against investment in existing homes.
Definitions for non-financial risk areas are likely to be largely qualitative, so boards should be clear about the behaviours, controls and assurance that would demonstrate whether the organisation is operating within appetite.
Surveying board members before a risk appetite workshop can add considerable value. Participants can be asked to suggest the organisation’s appetite for each category and explain their reasoning. Executive team members can also contribute, helping to identify any material differences in appetite before the board discussion takes place.
The results provide useful material for a facilitated board discussion. They show where there is broad agreement, where views differ and where further debate is needed to reach a collective position. Small group exercises can then test what level of risk would, and would not, be acceptable within each category.
Formalise the statement
The first draft of the risk appetite statement should build on the survey results and the consensus reached through workshop discussion. It should translate those discussions into clear boundaries for the executive team to work within. After review by relevant colleagues and the audit and risk committee, the final statement should be approved by the board and appended to the risk management framework or policy.
Embed in planning, decision-making and assurance
Once approved, the statement should be embedded in planning, decision-making and assurance. Board papers should show that budgets, cashflow forecasts and long-term financial plans meet the golden rules, while leaving sufficient resources to support other aspects of the risk appetite statement, such as the safety and quality of homes.
Strategic and performance reporting should provide regular assurance that the organisation remains within its agreed appetite. Finance packs should confirm whether the golden rules have been met, and cashflow forecasts should demonstrate compliance with liquidity requirements.
Major decisions may require additional stress testing to show their impact on financial resilience and the golden rules. The board should consider whether proposals would breach its agreed appetite, either by introducing new risks or increasing existing ones, and ensure the discussion is clearly minuted. Development gateway decisions should also confirm that proposed schemes can be delivered within the board’s risk appetite.
Manage exceptions carefully
Any opportunity that would exceed the agreed risk appetite should require specific board debate and formal approval. Boards may need to consider alternative approaches, such as joint ventures, partnerships, reprofiling investment programmes, external specialist advice or more frequent reporting. Exceptions should be uncommon, and boards should be alert to the risk of successive approvals gradually weakening the agreed boundaries.
Conclusion
Risk appetite is a core part of good governance. It gives housing associations clear boundaries for strategic planning, helps boards weigh opportunity against resilience and supports more confident decision-making. Boards should specify the assurance they need for qualitative risks and require regular evidence that financial plans and performance remain within agreed limits.
