Risk Appetite: 6 Blind Spots That Leave Safety Decisions Unfunded

A board can approve a safety policy, assign a risk owner, and still leave the operation without a defensible answer when production pressure collides with exposure. That gap is usually not caused by a missing risk matrix. It appears because the organization has never defined how much safety risk it is prepared to accept, who may accept it, and what evidence must exist before that decision is valid.

Risk appetite becomes useful when it changes a live operating decision. If it only appears in a governance document, it gives leaders language without giving supervisors authority. The six blind spots below show where that failure begins, how to test for it, and what a plant manager or EHS director can change in the next review cycle.

Why risk appetite belongs in safety governance

ISO 31000:2018 describes risk management as a structured approach to decision-making under uncertainty, while ISO 45001:2018 expects organizations to control hazards through an operational management system. Neither standard turns a risk appetite statement into a substitute for hazard control. The statement matters because it sets the boundary for escalation when controls are incomplete, degraded, or expensive.

A practical risk appetite statement answers three questions. Which exposures are never accepted without senior authorization? Which temporary deviations can a line manager approve, and for how long? What evidence proves that the selected controls remain effective while the work continues?

Andreza Araujo has spent more than 25 years working with EHS decisions across multinationals and more than 30 countries. Her experience, including more than 250 cultural transformation projects, points to a recurring distinction. A company may have a mature policy and still make immature decisions at the point of work when authority, evidence, and follow-up are disconnected.

That is why risk appetite should sit beside the risk register, barrier verification, management review, and field leadership routine. The risk register shows what the organization believes it knows. Risk appetite shows what it will do when that knowledge is incomplete.

Blind spot 1: treating risk appetite as a slogan

Statements such as “we have no appetite for serious harm” sound decisive, yet they rarely tell an operations leader what to do when a critical control is unavailable. The slogan becomes useful only after it is translated into a decision boundary that includes the exposure, the missing control, the authorized decision-maker, the maximum duration, and the required review.

A useful test is to place one degraded control in front of a production and EHS leadership team. Ask whether each person would select the same action, escalation route, and expiry time. If the answers differ, the organization has a communication problem, not merely a documentation problem.

The decision log should record the reason work continued, the control that replaced the original barrier, the person who accepted the residual risk, and the condition that ends the exception. This creates traceability without pretending that a score in a matrix has removed uncertainty.

Blind spot 2: confusing risk appetite with risk acceptance

Risk appetite is a boundary established before a specific event. Risk acceptance is a decision about a particular exposure after its context, controls, and uncertainty have been examined. Confusing the two allows a general statement from the board to become a blanket approval for local exceptions.

The distinction is visible in a shutdown. A company may have a low appetite for uncontrolled stored energy, yet still accept a defined residual risk during a planned intervention when isolation, verification, competent supervision, and rescue readiness are demonstrated. That acceptance is conditional, time-bound, and reviewable. It is not proof that the organization has a higher appetite for the hazard.

Use the risk acceptance myth review when leaders use the words interchangeably. The key question is whether the decision names the evidence that makes a specific exposure tolerable for a limited period.

Blind spot 3: giving budget owners no role in the boundary

Risk appetite fails when EHS owns the language but finance, engineering, maintenance, and operations own the resources that make controls possible. A capital request can be rejected while the safety statement remains unchanged, leaving supervisors to carry the unresolved conflict at the worksite.

For each material risk, identify the control that requires funding, the owner of that funding decision, the consequence of delay, and the date when the exposure must be reconsidered. A risk appetite statement without those four links is an aspiration that has not entered the operating model.

Andreza’s book Safety Culture: From Theory to Practice connects culture maturity with the decisions leaders repeatedly reinforce. The same principle applies to risk appetite. Workers learn the real boundary from what leaders fund, postpone, inspect, and escalate, not from the sentence printed in a policy.

At the next management review, compare approved safety commitments with the open actions in the risk escalation process. If the same control remains unfunded across two review cycles, the issue is no longer an isolated delay. It is evidence that the organization has not aligned appetite with resource authority.

Blind spot 4: using a risk matrix as the final authority

A matrix can organize discussion, but it cannot decide whether evidence is credible, whether a barrier is independent, or whether a supervisor has the capacity to manage a changing exposure. Two teams can assign the same rating while relying on different assumptions about maintenance, competence, workload, or emergency response.

Risk appetite should therefore define evidence gates alongside score ranges. For a serious injury or fatality exposure, the gate might require proof of the critical control, confirmation that the control owner is available, a field verification, and a response plan whose timing matches the credible consequence.

The control-of-work decision gates provide a useful comparison. They move the conversation from “what color is the risk?” to “what must be true before the work starts or restarts?” That shift makes the decision more observable and less dependent on the confidence of the person completing the form.

Blind spot 5: ignoring the speed of risk change

Risk appetite is often reviewed annually, although operational exposure can change within one shift. A contractor arrives late, a permit is extended, a weather front changes lifting conditions, or a maintenance backlog removes the redundancy that the original assessment assumed. The risk is not static simply because the register is updated monthly.

Define review triggers that match the velocity of the work. A changed critical control, a failed verification, a change in simultaneous operations, a new contractor, or a delay beyond the approved exception period should reopen the decision. These triggers make escalation predictable, which is especially important when supervisors face competing production demands.

A plant leader can test this blind spot by selecting five recent deviations and asking when each one crossed the threshold for escalation. If the answer depends on who noticed it rather than on an agreed trigger, risk appetite is operating as personal judgment.

Blind spot 6: measuring approval instead of control effectiveness

Many governance reviews report how many risk assessments were completed, how many exceptions were approved, or how quickly actions were closed. Those figures may describe administrative activity without showing whether exposure fell. A fast approval process can even hide weak control verification when the organization rewards closure more than evidence.

Use a small set of leading questions. Was the critical control present at the point of work? Did the owner verify it under the conditions in which it matters? Did the exception expire on time? Did the next review confirm that the replacement control remained effective?

These questions can sit beside the risk register review and the organization’s safety indicators, because a good dashboard should show where decisions remain exposed rather than only how many forms have been completed. In Andreza Araujo’s work, the practical value of a measure is tied to the management decision it changes.

What a defensible risk appetite review looks like

The following comparison separates a policy-level statement from an operating boundary that leaders can verify. The distinction is important because both versions may use the same words while producing very different behavior.

Run this review with the people who create the exposure, control the work, fund the correction, and accept the residual risk. When those roles are absent from the same conversation, the final statement may look complete while the decision system remains fragmented.

How leaders can reset the boundary in one review cycle

Start with the three exposures that could produce the most serious consequence, not with the easiest risks to score. For each one, name the non-negotiable control, the temporary alternative, the authorized decision-maker, the escalation trigger, and the evidence required to continue.

Then review one live exception in the field. Compare what the written decision assumed with what the supervisor, contractor, or operator actually encountered. This is where a risk appetite statement becomes a management control, because the organization can see whether its boundary survives contact with work.

Finally, publish the decision route in the same places where work is planned. If the escalation rule lives only in a board paper, it will arrive too late. If it appears in the permit, shift handover, risk register, and supervisor routine, people can act before exposure becomes normalized.

Risk appetite does not remove uncertainty, and it does not authorize leaders to tolerate weak controls. Its value is more demanding. It makes the organization state who may decide, what must be verified, how long an exception may last, and what evidence will reopen the question.