Hello,

I have recently moved to a smaller institution ($230M in assets). It is advisable to work with the board to create an formal Risk Appetite Statement? I think it would be beneficial, and dictate the level of board accepted risk throughout the organization. But, being smaller I am not sure it is necessary. Wanted to check with everyone before pushing for it. Also, if anyone was gracious enough to share a copy of their statement I would greatly appreciate it.

Thank you!

I assume you are referencing this from an ERM perspective. Personally, I don't think it is necessary for smaller organizations and the recent (informal) survey's I have heard seem to reflect this.

That said, it wouldn't hurt anything and there is still speculation that a risk appetite statement is the way of the future - which it may be once the next recession comes around.

Hi Adam,

Yes, you are correct - from an ERM perspective, not just IT (sorry for not clarifying).

Appreciate the feedback.