Risk appetite must be operational

Risk appetite becomes operational when it changes a permitted action under specified conditions. A general statement that the institution has a low appetite for disruption can express an intention, but it does not identify who may accept a proposed exposure, what evidence is required or what happens when a condition fails. The decision record should translate that intention into the relevant objective, constraint, authority and response. The translation is context dependent. This study does not propose a universal probability or severity threshold for every institutional reader.

An appetite statement can concern different objects. It may constrain the chance of a defined event, the consequence if it occurs, the resources spent on treatment, the period of exposure or the evidence required before commitment. These conditions should not be merged into a single score unless the tradeoffs and authority for doing so are explicit. A positive economic comparison does not waive a mandatory condition. A strict consequence condition does not automatically justify any resource request. The record should identify which condition decides each branch and which conditions remain open.

The fictional dispatch mandate deliberately separates optional economics, consequence acceptance and implementation evidence. The optional condition uses a nonnegative net annual control value. The consequence condition asks for a viable response to the declared major-event scenario. The implementation condition requires evidence of operating support, delivery access and actual authority. These are authored conventions for the demonstration, not actual institutional policies. Their value lies in showing why a favourable result can support further investigation without authorising installation, and why an adverse optional result can coexist with a legitimate different mission question.

Authority should attach to an act and an exposure boundary. The fictional Chair can approve or stop the bounded information purchase. The Operating Owner supplies the mechanism and response applicability. The custodian maintains the evidence objects and status. The Mechanism Analyst preserves exact calculations and challenged interpretations. The Assurance Reviewer reports independently on the claim and process. These roles are not substitutes for an actual corporate delegation, regulatory requirement or employment assignment. A real application would need to replace them with named responsibilities and verified authority before any commitment.

Acceptance should be recorded as a proposition, not a feeling about the report. A committee may accept the calculation as a faithful reproduction of the fixture, accept an input estimate as supported within a range or accept a residual exposure under a particular mandate. These are different approvals. The record should state what has been accepted and what remains held. A signature on the cover of a model pack can otherwise be interpreted too broadly by later teams. Clear scope protects both the decision maker and the operator who must act on the result.

Stop authority is as important as acceptance authority. A record that names who may approve a response but not who may halt an incomplete or invalid claim encourages continued exposure by default. In the fictional mandate, the Chair stops the information purchase at the cap or gate unless a fresh mandate is granted. The custodian can report that a requested item is unavailable, and the reviewer can challenge the evidence basis, but neither can silently renew the spending authority. The Operating Owner should also identify any immediate operational safety authority separately; this paper does not invent that emergency delegation.

The record does not authorise spending the annual control-cost input. That input belongs to the economic comparison. The diligence cap is a separately declared information exposure. Mixing the two would both alter the appraisal and obscure authority. A favourable annual model result may justify investigating the repair proposal, but it does not establish the cash, access or contractual terms needed to install it. The bounded information act therefore remains the only permitted action in the completed fictional branch.

The committee's preserved answer is discriminating. It permits the scoped evidence purchase, rejects the expensive optional proposition, holds implementation of the eligible repair, holds equivalent acceptance of the major-consequence case and holds invalid aggregate or count interpretations. These are not five versions of a general warning. Each attaches to a different failed or unresolved condition. Their different next acts are part of the demonstrated advantage of the decision system over an undifferentiated residual score.

Relative dates can make a dependency visible without pretending that the real calendar is known. The fictional preparation interval runs from the declared start before D to the gate before D, where D is the unresolved implementation boundary. The dates do not prove that access, procurement or operating windows exist. If D changes, the record should reassess the sequence and authority rather than simply slide every task. A relative timetable is a conditional plan. The actual date, source availability and delivery terms remain independent constraints that can defeat the preferred sequence.

A deadline should specify what happens when evidence is incomplete. In this record, the gate does not convert a missing availability report into an assumed favourable value, nor does it require the analyst to declare the safeguard ineffective. It ends the bounded information mandate and retains the implementation hold. The Chair can consider a fresh scoped request if the unanswered question remains important. That fresh decision should preserve the previous exposure and reason for incompletion. Repeatedly extending the gate without a new mandate would undermine the very boundary the timetable was meant to establish.

Distinguish temporary containment from acceptance by testing what happens when the temporary arrangement expires. An institution may continue a limited activity because a workaround protects its minimum service, yet have no acceptable route for normal operation. If removing the workaround would breach the service condition, the exposure has not disappeared; it has moved into the workaround's availability and duration. Define that dependency explicitly and examine the exit route. The unresolved branch remains unresolved if restoration cannot be demonstrated. This diagnosis permits a proportionate temporary act without converting inability to eliminate uncertainty into permanent acceptance of the original operating design.

The cost-heavy case demonstrates a completed rejection under a defined optional condition. It is not merely a red score awaiting interpretation. The frozen inputs yield a negative net annual value despite improved expected-loss protection, so the optional proposal fails. A changed cost basis or different intervention can be reconsidered through a fresh comparison. A mandatory constraint can justify a different appraisal. Keeping these routes explicit makes rejection informative rather than absolute. It prevents an analyst from either suppressing the negative result or using it to dismiss every possible reason for protection.

The rare-major case demonstrates a completed hold under another condition. Its matching mean does not establish the necessary response capability, and that capability evidence has not been supplied. The Chair therefore holds equivalent-acceptability and implementation claims. This is a different decision from the optional economic rejection. A useful committee record should make the distinction readable, because the next work differs: the rejection calls for changed economics or mandate, while the hold calls for a defined missing proposition. A single status colour can conceal those different routes.

A practical appetite framework should be tested against awkward examples before it is adopted. The free ineffective control, the duplicated loss ledger and the probability cap all challenge the temptation to accept a favourable-looking field. If the policy routes these examples to implementation solely because a numeric metric meets a threshold, the policy's conditions are incomplete. If it blocks every information purchase until all operating uncertainty is removed, it may prevent useful learning. The framework should permit bounded progress while preventing unsupported exposure, and should preserve the authority for both decisions.