risk appetite, tolerance, and limits

Think of a family planning how much of their savings they are willing to put at risk. They might say, in plain words, 'we are happy to invest for growth, but we never want to risk losing the house.' That sentence is their risk appetite. Then they get specific: 'we will keep at least six months of expenses in cash, and no single stock can be more than 10% of our money.' Those concrete rules are their limits. Risk appetite, tolerance, and limits are the same idea scaled up to an insurer — turning a fuzzy comfort level into hard numbers people can actually obey day to day.

The three sit in a hierarchy. Risk appetite is the board's high-level statement of how much and what kinds of risk the firm is willing to take in pursuit of its goals — often phrased as a target, such as 'we want to be able to survive a 1-in-200-year year and still be solvent.' Risk tolerance is the boundary of what is acceptable around that — how far results may stray before action is required (for example, 'we will not let the chance of breaching our capital requirement exceed a stated low level'). Risk limits are the bite-sized operational rules that keep the firm inside the tolerance: caps per line of business, per counterparty, per asset class. If a trader's position would breach a limit, the trade is stopped — the limit is where the appetite finally touches a real decision.

This framework matters because without it, ERM is just talk. A capital number means little unless the board has first declared how much risk it actually wants; the appetite is the benchmark everything else is measured against. The common failure is an appetite statement so vague ('we are prudent') that it can never be breached and therefore never bites. A good appetite is uncomfortable: it must be specific enough that a profitable opportunity sometimes has to be turned down.