Raymond Cheung
Chartered Actuary · CRO · Board Adviser · Singapore
Risk appetite statements are everywhere. Frameworks that genuinely influence how an organisation makes choices are far rarer. The difference is not technical, it is about whether leadership is willing to be constrained by it.
A risk appetite framework that does not change how a single decision is made in the year it was approved is not a governance tool, it is a reporting artefact. In my years as a statutory CRO, first at AIG Asia Pacific and then at Basel Medical Group, I saw this pattern repeatedly: a well-constructed risk appetite statement approved by the board, filed with MAS, and absent from every capital allocation, underwriting decision, and strategic discussion that followed. Singapore's MAS Notice 126 requires boards of licensed insurers to set a risk appetite and ensure the enterprise risk management framework is genuinely operating, not merely documented. The organisations that get this right connect the framework to the moments where risk is actually being taken, and they hold management to account for the answer.
Risk appetite, the amount and type of risk an organisation is willing to accept in pursuit of its objectives,should be the anchor for strategic decisions. It should be the framework that a CFO invokes when evaluating a capital allocation, that an underwriter references when pricing a risk, that a board director reaches for when a management proposal tests the boundaries of what the organisation has said it stands for. In practice, most risk appetite frameworks sit behind the enterprise risk policy and are referenced at half-yearly risk committee meetings.
Why frameworks fail
In my years as a statutory CRO, I saw this pattern consistently. A risk appetite framework gets developed, usually with significant effort from the risk function, real engagement from the CFO, genuine sign-off from the board. It is well-designed. It identifies the right categories of risk. It sets sensible thresholds. And then nothing changes.
The failure is almost never in the framework itself. It is in three things: the framework is not embedded in decision-making processes; management is not held to account when risk appetite boundaries are approached or breached; and the board is not asking the right questions in the right forums.
“A risk appetite statement that does not constrain a single decision in the year it was approved has no appetite in it at all.”
What embedding actually looks like
Embedding risk appetite is not about putting it in a dashboard. It is about connecting it to the moments where decisions are actually made, capital committee papers, product approval processes, M&A due diligence, strategic planning cycles.
At AIG Asia Pacific, we worked hard to move risk appetite from a document that informed the annual report to a framework that shaped how businesses submitted capital requests. That required two things: a clear articulation of appetite in terms that business units could actually use, and consistent challenge from the risk function when proposals pushed against the stated boundaries. The second part is the harder one, it requires the CRO to be willing to slow things down, and it requires the CEO and board to support that when it happens.
The board's role
Boards set risk appetite. But in my experience, too few boards follow up on whether that appetite is actually operating as intended. The question to ask is not 'Are we within appetite?', management will almost always say yes. The question is: 'Show me a decision made in the last six months where the risk appetite framework caused us to do something differently than we otherwise would have.'
If the answer is silence, the framework is decorative. A functioning risk appetite framework should be producing real friction, decisions slowed down, proposals modified, strategies adjusted because the organisation has made a commitment to itself about the kind of risk it is willing to carry.
A practical starting point
- Translate your risk appetite into decision-relevant language for each business function, not just risk categories, but thresholds they can actually apply
- Connect it explicitly to your capital allocation, underwriting guidelines and product development process
- Build a reporting cadence that shows the board where the organisation is sitting relative to appetite, not just whether it is within limits, but how the trend is moving
- Require management to cite risk appetite in board papers where it is relevant, and challenge when it is absent
Risk appetite is not a compliance exercise. When it works, it is the mechanism by which a board's risk judgement travels through the organisation and shapes the decisions being made three layers down. That is worth building properly.
Common Questions
What is a risk appetite framework and why does it matter for Singapore boards?
A risk appetite framework is the structured set of statements, thresholds and metrics that define the amount and type of risk an organisation is willing to accept in pursuit of its objectives. For Singapore boards, MAS expects risk appetite to be a genuine governance tool, not a compliance document. MAS guidelines on corporate governance require boards to approve the risk appetite framework and satisfy themselves that it is embedded in strategic and operational decision-making, not merely referenced in risk committee papers.
How do Singapore boards ensure risk appetite is actually used in decisions?
The most common failure is embedding risk appetite in a framework document rather than in decision-making processes. For a Singapore board to ensure risk appetite is operational, it should require management to cite risk appetite in board papers where it is relevant, ask to see decisions in the past six months that the framework caused the organisation to change, and demand reporting that shows where the organisation sits relative to appetite, including trend direction, not just a binary within-limits or breach flag. Boards that only hear 'we are within appetite' without seeing the underlying analysis are not governing risk appetite, they are receiving reassurance.
What is the difference between risk appetite and risk tolerance for Singapore regulated entities?
Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives, expressed at a strategic level. Risk tolerance is the acceptable variation around those appetite boundaries, the operational bandwidth within which day-to-day decisions can move without escalation. For Singapore insurers regulated by MAS, the ORSA process requires both to be defined and stress-tested against the organisation's capital position. In practice, risk appetite is set by the board and risk tolerance is managed by the CRO and business units, with a clear escalation path when tolerance boundaries are approached.
Related insights
About the author
Raymond Cheung is a Chartered Actuary, C-suite executive and board adviser with more than 20 years of experience across Asia in risk management, insurance, ESG and corporate governance. He is the CEO of CER Consultancy and an accredited trainer at SMU Academy and the Singapore College of Insurance.