Organization Risk Appetite 

Published: August 2026 | Version: 1.0 | Last updated: August 2026 

Applies to: Municipalities, school boards, housing foundations, and community groups 

Purpose: This bulletin supports members in defining and managing risk appetite in alignment with service delivery objectives, regulatory requirements, and public accountability expectations 

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. Establishing an effective risk appetite framework is important because it helps define the organization’s risk profile and supports the development and implementation of its strategic objectives. 

A risk appetite framework can also support members by: 

• Supporting strategic planning and decision-making 
• Improving governance and accountability 
• Guiding the allocation of resources 
• Shaping the organization’s approach to risk 
• Improving risk management strategies by clearly defining and quantifying risk appetite 

Developing a risk appetite framework 

Risk appetite should align with the organization’s strategic objectives. After identifying its objectives and goals, the organization should define its risk categories. 

Common risk categories in the public sector include:  

• Strategic  
• Financial  
• Operational 
• Safety  
• Compliance  
• Technology and cybersecurity 
• Infrastructure and assets 
• Reputation 
• Environmental 

Once these categories have been identified, the organization should develop qualitative statements describing acceptable levels of risk. The next step is to create a five-point risk appetite scale to quantify and communicate the organization’s risk appetite. 

A five-point scale typically includes: 

• Very low =1 
• Low =2 
• Moderate =3 
• High =4 
• Very high =5 

Finally, the organization should create a risk register that combines risk categories, ratings, qualitative statements, and other relevant information. The risk register is a practical tool for monitoring, assessing, and managing risks in alignment with the organization’s strategic objectives. 

The following is a sample risk register:  

A risk appetite framework requires the support of major stakeholders across the organization. Their involvement helps ensure that the organization’s risk appetite aligns with its strategic objectives, regulatory requirements, and operational realities. 

The risk register supports this process by providing a central repository for identifying, assessing, monitoring, and reporting risks across the organization. By providing a clear view of current and emerging risks, the risk register helps stakeholders make informed decisions within approved risk appetite levels. 

Additional considerations when creating a risk register 

Risk heat map 

A risk heat map visualizes risks based on likelihood and impact. Municipalities typically have a low appetite for safety, environmental, and regulatory risks, which may place these risks in the red zone. Below is a sample heat map; 

Heat maps help leadership focus resources on risks with the highest impact and likelihood. Based on the heat map, municipalities may focus risk mitigation plans and regular monitoring on risks in the orange and red zones. Risks in the green and yellow zones may be managed through regular operational controls. 

This approach supports efficient risk management by directing attention and resources to areas that pose a greater threat to the organization’s objectives.  

Additional considerations for developing a risk heat map 

• Define likelihood and impact criteria clearly to support consistent risk assessments across the organization 
• Assess current mitigation controls when evaluating inherent and residual risk 
• Consider emerging threats such as severe weather events, climate change impacts, supply chain disruptions, and cyber threats 
• Support risk ratings with loss history, inspection findings, claims data, and input from subject matter experts 
• Review risk matrices regularly to ensure ratings remain accurate and relevant  

Risk appetite summary 

Defining risk appetite supports consistent and informed decision-making. Together, the risk appetite framework, risk register, and heat map help organizations balance risk and opportunity. They support the active management of significant risks while ensuring lower-level risks are also addressed. 

This process can be complex. RMA Insurance’s Risk Advisors are available to assist with questions about organizational risk appetite. 

Questions

For more information, contact your Risk Advisor or the Risk Team at risk@rmainsurance.com. 

*This bulletin is provided by RMA Insurance for general information only. It is based on our understanding of current law and practice as of the date of publication and does not constitute legal, financial, risk management, or other professional advice, or an interpretation of any insurance policy. Coverage is governed solely by the terms of your policy. Organizations remain responsible for complying with their legal obligations and determining the risk management measures appropriate for their operations. Any use of this information is at the reader’s discretion. For advice on your specific situation, contact your RMA Risk Advisor or legal counsel.