What is the effective process for approving a risk appetite statement?

• A. Auto-approval by department head.
• B. Board or executive approval with top management sign-off and periodic review.
• C. External auditor approval only.
• D. Approval after the project ends.

Answer: (B)

Governance and ongoing oversight are essential when establishing a risk appetite. The risk appetite statement sets the amount and type of risk the organization is willing to take in pursuit of its strategic objectives, so it needs formal approval from the top to ensure alignment with strategy and accountability across the organization. Board or executive approval provides the necessary authority and oversight, while sign-off by top management ensures that the appetite is translated into concrete decision-making and risk-taking practices throughout the business. Regular, periodic reviews keep the appetite current as strategy, markets, and regulations evolve, allowing timely updates when conditions change.

Auto-approval by a department head bypasses centralized governance and can lead to inconsistent risk-taking across units. External auditors provide assurance on controls and compliance, not the governance of risk appetite itself. Approval after a project ends is ineffective because it occurs too late to prevent or manage risks within that project.