Almadar A board meeting in KAFD that talks about risk tolerance in general terms hasn't actually set a threshold anyone in the business near Olaya can measure a decision against.
This is the piece that turns enterprise risk management from a reporting exercise into an actual decision-making tool, and it depends on an accurate underlying risk register, since you can't set a meaningful threshold for a risk category you haven't properly identified and quantified first.
Why vague risk appetite statements don't help anyone
A board policy stating the company has a 'moderate' appetite for risk gives management nothing to actually work with when deciding whether to accept a large new customer that would represent forty percent of revenue, or whether to expand into a new city that doubles a specific operational exposure. Specific, numeric thresholds are what make the concept usable rather than a phrase in a governance document nobody references when a real decision comes up.
Getting genuine board sign-off, not just a signature
The actual thresholds need real discussion and agreement from the people accountable for the consequences if a risk materializes, not a document drafted by management and rubber-stamped in a board meeting without the board genuinely engaging with what the numbers mean in practice.
Connecting appetite to specific decisions
Once thresholds exist, they should directly inform specific risk assessments commissioned for major decisions, a new market entry, a large contract, an acquisition, giving the assessment team a genuine benchmark to measure against rather than a subjective judgment call made independently each time.
Avoiding the trap of setting thresholds too conservatively
A framework set so conservatively that it effectively blocks any meaningful growth decision isn't actually risk management, it's risk avoidance dressed up as governance. Genuinely useful thresholds allow the business to take on calculated risk deliberately, with eyes open, rather than either avoiding growth entirely or drifting into risk without anyone having actually decided to accept it.
A group with entities in Riyadh may reasonably set different appetite thresholds by entity, a higher tolerance for customer concentration in a stable service business than in a project-dependent contracting arm, rather than forcing one uniform threshold across genuinely different risk profiles.