“Is this within our risk appetite?”
It's a question that appears in almost every serious investment discussion, and yet, in many business cases, it’s never clearly defined. Instead, risk appetite tends to sit in the background as a vague, qualitative idea:
“We’re relatively risk averse right now”
“Leadership is open to innovation”
“This might be pushing it”
However, such ambiguity creates a problem because if risk appetite isn’t translated into something measurable, it can’t meaningfully guide decisions. A strong business case doesn’t just describe risk; it shows whether that risk sits inside or outside what the organisation is willing to accept.
In this guide, we’ll break down what “risk appetite” actually means in practice and how to turn it into something you can model, test, and defend.
What is “risk appetite” (in simple terms)?
At its core, risk appetite is the level of uncertainty an organisation is willing to accept in pursuit of value. That uncertainty can show up in different ways:
Financial volatility; ROI may vary significantly depending on assumptions
Downside exposure; there is a real possibility of loss
Delivery risk; timelines, dependencies, or execution may slip
Strategic risk; impacts to compliance, reputation, or positioning
The important distinction is this:
Risk appetite isn’t about avoiding risk; it’s about defining how much risk is acceptable for a given level of return. Without that definition, “risk” becomes a vague matter of opinion, rather than a decision input.
Why most business cases get this wrong
Most business cases acknowledge risk, but stop short of making it actionable, so you’ll typically see a list of risks with brief descriptions, a RAG status or qualitative rating, and occasionally, a sensitivity table.
What’s missing is the connection between the risk itself, the quantified impact of that risk, and the point at which the organisation would say ‘no’. Without that link, “risk appetite” becomes subjective, as one stakeholder may see acceptable exposure, while another sees unnecessary risk, and the discussion shifts from analysis to opinion.
The goal isn’t to eliminate judgment entirely, but to anchor it in a shared set of assumptions and thresholds that can be tested.
Turning risk appetite into something measurable
To make risk appetite useful, you need to translate it into concrete decision boundaries. In practice, this usually comes down to three areas:
1️⃣ Define acceptable downside
Start with the most direct question:
How bad can this get before the case would be rejected?
This can be expressed in several ways, such as a minimum acceptable ROI, a worst-case NPV threshold, or a maximum financial loss.
👉 e.g.
“We won’t proceed if the worst-case ROI drops below 5%”
“Total downside exposure must remain under $2M”
This creates a clear red line; if your downside scenario crosses it, the case sits outside the organisation’s appetite, regardless of upside.
It also forces a level of honesty in modelling, because if the downside hasn’t been explored properly, it becomes obvious very quickly.
2️⃣ Define acceptable variability
Risk isn’t only about the worst-case outcome, but also about how wide the range of possible outcomes is. Two projects may have the same expected ROI, but very different levels of uncertainty, so this is where questions of variability come in:
How wide is the ROI range across scenarios?
How sensitive is the outcome to key assumptions?
What is the probability of achieving the base case?
Scenario modelling and sensitivity analysis play a central role here:
Best case, base case, and worst case comparisons
Stress-testing key drivers such as adoption, cost, or timing
Understanding which variables have a disproportionate impact
A project with strong average returns but extreme volatility may well fall outside of the risk appetite, particularly in environments where predictability matters more than upside.
3️⃣ Define strategic boundaries
Not all risks are financial, and not all risks are negotiable, so some will sit outside of appetite regardless of the return profile, e.g.
Regulatory or compliance breaches
Reputational damage
Misalignment with strategic priorities
These aren’t trade-offs; they’re constraints, and making these explicit early in the business case often prevents wasted effort later, because if a proposal conflicts with a non-negotiable boundary, no amount of financial upside will change the outcome.
Bringing it together: risk appetite in practice
A well-structured business case connects risk, impact, and decision thresholds in a way that’s both visible and testable. In practice, that means combining:
🆚 Scenario modelling to show a range of outcomes
⚠️ Clear identification of risks and their drivers
🧮 Quantified downside, often through risk-adjusted metrics
✔️ Explicit thresholds that define acceptability
This means that instead of relying on general statements like “This project carries moderate risk”, you can present something far more concrete.
👉 e.g.
“Worst-case ROI remains above our 5% threshold”
“There is a 75% probability of exceeding the hurdle rate”
“No identified risks breach compliance constraints”
This shifts the conversation from subjective judgment to evidence-based discussion.
In practice, this is also where tools like KangaROI tend to change the dynamic, because rather than merely treating risk as a static list or a one-off exercise, you can:
Model multiple scenarios without rebuilding the case each time
Quantify downside through structured risk inputs and EMV
Test how close the case sits to your own defined thresholds as assumptions change
The result is not just a clearer picture of risk, but a more consistent way of assessing whether a case remains within appetite as it evolves.
The role of trade-offs
This is where things get interesting, as risk appetite isn’t fixed; it shifts depending on context. This means that an organisation may accept higher levels of uncertainty when the initiative is strategically critical, the potential upside is transformational, or if there is a need to move quickly.
Conversely, appetite tends to narrow when the objective is cost reduction or efficiency, budgets are constrained, or if prior initiatives have underperformed.
The real decision is rarely “is this risky?”; it’s whether the level of risk is justified by the expected value and the strategic context. Strong business cases make these trade-offs visible:
Higher return versus higher uncertainty
Faster delivery versus increased execution risk
Lower cost versus reduced resilience
This is another area where a more structured approach makes a difference; when trade-offs are modelled explicitly, rather than described qualitatively, stakeholders can see how shifting one variable impacts both value and risk at the same time. That makes conversations more grounded, and decisions easier to defend.
Common pitfalls to avoid
⚠️ Treating risk appetite as purely qualitative
Relying on phrases like “low risk” or “within appetite” without defining what those mean creates inconsistency, and different stakeholders will likely then interpret the same language in different ways, leading to misalignment during decision-making.
🕒 Defining thresholds too late
If acceptable downside or variability is only discussed during the review stage, it often results in shifting goalposts. Establishing these boundaries upfront ensures the business case is built to the right criteria from the start.
📈 Focusing only on upside
It’s common to spend a disproportionate time refining the base case and best case, while giving limited attention to the downside. In reality, approval decisions are often driven more by the worst-case scenario than the expected outcome.
🧩 Overcomplicating the model
There’s a temptation to build highly detailed risk models with complex distributions and assumptions. But if stakeholders can't follow how the numbers are derived, trust erodes quickly, so simplicity and transparency are more valuable than technical sophistication.
🚫 Ignoring non-financial constraints
Financial metrics alone don’t define risk appetite, so overlooking regulatory, reputational, or strategic boundaries can result in cases that appear strong on paper but are fundamentally unviable.
🔁 Treating risk as a one-off exercise
Risk appetite isn’t something you assess once and move on from. As projects progress and assumptions change, the level of risk can shift, so failing to revisit and update this view reduces the relevance of the original business case.
🔗 Not linking risk to decisions
Listing risks without showing how they influence the final recommendation weakens the case. Decision-makers need to see not just what the risks are, but how they affect whether the project should proceed.
The common theme across these pitfalls is a lack of connection between risk, measurement, and decision-making, so addressing that gap is what makes risk appetite genuinely useful.
Conclusion
“Risk appetite” often sounds like a high-level, strategic concept, but in a business case, it should be far more practical:
Clear thresholds that define acceptable outcomes
Defined scenarios that show how results may vary
Explicit trade-offs that reflect real decisions
When those elements are in place, the conversation changes, so instead of debating whether something “feels risky”, stakeholders can evaluate whether it sits within clearly defined boundaries.
That shift brings consistency to decisions, improves confidence in the numbers, and makes the business case a more effective tool for alignment. It also creates a foundation for tracking whether outcomes and risk levels stay within appetite long after approval.
