{"id":6125,"date":"2026-01-29T09:53:38","date_gmt":"2026-01-29T09:53:38","guid":{"rendered":"https:\/\/www.theirmindia.org\/blog\/?p=6125"},"modified":"2026-01-29T09:53:38","modified_gmt":"2026-01-29T09:53:38","slug":"risk-appetite-vs-risk-capacity-what-boards-want-vs-what-balance-sheets-can-actually-bear","status":"publish","type":"post","link":"https:\/\/www.theirmindia.org\/blog\/risk-appetite-vs-risk-capacity-what-boards-want-vs-what-balance-sheets-can-actually-bear\/","title":{"rendered":"Risk Appetite vs Risk Capacity: What Boards Want vs What Balance Sheets Can Actually Bear"},"content":{"rendered":"

\"Getting<\/a><\/p>\n

Every board wants growth. Every CFO worries about survival. Somewhere between ambition and solvency lies the tension that defines modern <\/span>enterprise risk management<\/b><\/a>: the gap between <\/span>risk appetite<\/b> and\u00a0<\/span>risk capacity<\/b>. Understanding where these two concepts meet\u2014and where they diverge\u2014can be the difference between strategic boldness and reckless overreach.<\/span><\/p>\n

Defining the Terms: IRM’s Framework<\/b><\/h2>\n

The <\/span>Institute of Risk Management (IRM)<\/b><\/a> defines\u00a0<\/span>risk appetite<\/b>\u00a0as “the amount and type of risk that an organisation is willing to take in order to meet their strategic objectives”. It is fundamentally about pursuit\u2014what the board actively chooses to accept and embrace in order to grow, innovate, or compete. Risk appetite is not static; it varies by sector, culture, objectives, and time. A fintech disrupting payments may run with a higher appetite for regulatory ambiguity than a century-old insurer protecting policyholders’ funds.<\/span><\/p>\n

Risk tolerance<\/b>, a sibling concept, refers to an organisation’s readiness to bear risk after risk treatments, essentially the permissible deviation from the stated appetite before escalation or remediation is triggered. IRM notes that tolerance statements become “lines in the sand” beyond which the organisation will not move without prior board approval.<\/span><\/p>\n

Risk capacity<\/b>, by contrast, refers to the maximum level of risk the institution can withstand before solvency or stability is threatened. If appetite is about desire and tolerance is about boundaries, capacity is about physics\u2014the hard limit beyond which the organisation breaks. For a bank, capacity might be the point at which capital adequacy ratios are breached; for a manufacturer, it might be the debt-to-equity threshold at which lenders call in covenants.<\/span><\/p>\n

Why the Distinction Matters<\/b><\/h2>\n

Boards set appetite. Balance sheets reveal capacity. The danger arises when appetite exceeds capacity\u2014when strategic ambition outpaces <\/span>financial resilience<\/span>.<\/span><\/p>\n

Consider a mid-sized Indian bank that sets its risk appetite to restrict real estate lending to 10% of its total credit portfolio, with a tolerance band of 8\u201312%. Stress tests, however, show that a 15% exposure would breach capital adequacy norms\u2014that 15% mark is the bank’s risk capacity. If market exuberance or competitive pressure pushes the bank to 14%, it is operating within appetite but dangerously close to capacity. One adverse quarter could tip it over.<\/span><\/p>\n

This is not a theoretical problem. The 2008 global financial crisis, the IL&FS collapse in India, and multiple NBFC failures have roots in appetite\u2013capacity misalignment. Boards approved aggressive growth strategies (appetite) without fully stress-testing whether balance sheets could absorb tail-risk scenarios (capacity).<\/span><\/p>\n

The Board’s Role: Setting Appetite, Stress-Testing Capacity<\/b><\/h2>\n

IRM guidance emphasises that risk appetite and tolerance must be “high on any board’s agenda and are a core consideration of an enterprise risk management approach”. Boards are responsible for defining this all-important part of the <\/span>risk management<\/span> system and ensuring that the exercise of risk management is consistent with that appetite, which must remain within the outer boundaries of risk tolerance.<\/span><\/p>\n

But here is where many boards fall short: they articulate appetite without rigorously quantifying capacity. A risk appetite statement might say, “We are willing to accept moderate credit risk to expand our SME lending book.” That is directionally useful. However, unless the board also asks, “What is the maximum default rate our capital base can absorb before we breach regulatory thresholds or trigger rating downgrades?”, the statement remains aspirational rather than actionable.<\/span><\/p>\n

IRM’s consultation paper on risk appetite recommends that boards consider four dimensions of maturity: business context, <\/span>risk management culture<\/b><\/a>, <\/span>risk management processes<\/span>, and risk management systems. Critically, <\/span>risk culture<\/span> affects an organisation’s ability to function within its risk appetite. A culture that rewards short-term revenue without penalising risk accumulation will inevitably push actual exposures toward\u2014and beyond\u2014capacity.<\/span><\/p>\n

Practical Questions for Indian Boardrooms<\/b><\/h2>\n

IRM sets out the following questions that directors should ask:<\/span><\/p>\n