Which governance body is typically responsible for approving a risk appetite statement and ensuring ongoing oversight?

• A. Board of Directors or an equivalent top governance body.
• B. Audit committee only.
• C. External regulator.
• D. Finance department.

Answer: (A)

At the heart of this question is who has the ultimate responsibility for guiding an organization’s approach to risk. The risk appetite statement expresses how much risk the group is willing to accept in pursuit of its objectives and sets the boundaries for all strategic and operational decisions. Approving this policy and providing ongoing oversight sits with the board of directors (or the highest governance body in the organization) because they are accountable for the overall direction, culture, and long-term sustainability of the entity. They ensure the appetite aligns with strategy, capital, and stakeholder interests, and they monitor performance to keep risk within those agreed limits.

The audit committee often plays a key supporting role, reviewing risk management processes, internal controls, and assurance activities, but it does not typically be the primary authority approving the risk appetite. An external regulator governs supervision and compliance but does not normally approve an internal appetite statement. The finance department handles day-to-day financial risk management and reporting, operating within the appetite set by the board, rather than setting or approving that appetite itself.