Safety Risk Appetite: 5 Questions Exposing Governance Gaps

A safety risk appetite statement can sound decisive while leaving the hardest operating decisions untouched. A board may declare that people come before production, yet a supervisor still has to decide whether work continues when a critical control is unavailable, a contractor is late, or a schedule has already slipped.

The useful test is not whether the organization has published a statement. It is whether the statement changes authorization, escalation, funding, supervision, and stop-work decisions. ISO 31000:2018 treats risk management as part of governance and decision-making, while ISO 45001:2018 requires organizations to manage occupational health and safety risks through leadership, worker participation, operational control, and performance evaluation. A safety risk appetite becomes credible only when those management-system elements point in the same direction.

What is safety risk appetite?

Safety risk appetite is the leadership position on the types and levels of occupational risk an organization is prepared to retain while pursuing its objectives. It is not a promise that every activity will be risk-free. It is a set of boundaries that tells people which exposures are unacceptable, which activities may continue only after controls are verified, which decisions require escalation, and who has authority to accept residual exposure.

This distinction matters because ordinary risk assessments often describe exposure without establishing decision rights. A risk register can show a severe consequence and a moderate likelihood, yet the document may not say who can authorize the work, what evidence is sufficient, or when the assessment must move to a higher level. COSO guidance on risk appetite makes a similar governance point by treating appetite as something that should help executives and managers communicate how risk supports or threatens objectives.

Andreza Araujo has spent more than 25 years in executive EHS work, and her safety leadership perspective points toward a practical question. What will leaders refuse, fund, verify, and escalate when operational pressure makes the safer option slower or more expensive? A sentence that cannot answer those questions is communication, not governance.

Question 1: Does the statement define an unacceptable boundary?

The first gap appears when the statement uses broad language such as no harm, zero tolerance, or world-class safety without naming the conditions that cannot be traded. A credible boundary describes exposure in operational terms. Examples include uncontrolled high-energy work, bypassed isolation, entry into a confined space without verified atmospheric controls, or a known critical barrier that has failed without an approved alternative.

The boundary must also distinguish deliberate bypass from unavoidable residual risk. Routine work can retain some exposure after controls are applied, but a manager should not be able to redefine an uncontrolled fatal exposure as acceptable merely because the production consequence of stopping is inconvenient.

James Reason work on latent failures helps explain why this distinction matters. Serious events are rarely produced by one visible action alone. Organizational decisions, design weaknesses, maintenance conditions, supervision, and local work pressures can align before the final error becomes visible. A risk appetite statement that focuses only on personal caution leaves those upstream conditions outside the boundary.

Use the boundary as an approval test. If the critical control is absent, the work either stops, changes method, or receives a documented escalation decision from the role named in the governance process. That is more useful than asking whether the team feels comfortable with the remaining risk.

Question 2: Does it separate appetite from operating tolerance?

Risk appetite and risk tolerance are related, but they are not interchangeable. Appetite expresses the leadership position toward a class of risk. Tolerance defines the operating range that may be managed under specified conditions. If the two are merged into one broad statement, field teams receive a slogan rather than a decision rule.

Consider high-risk maintenance during a planned outage. Leadership may have no appetite for uncontrolled release of stored energy. The operating tolerance may allow the task to proceed when isolation points are identified, locks are applied, zero energy is tested, and an independent verification is recorded. The tolerance does not weaken the boundary. It explains what must be true before the work can enter the allowed range.

This is where a clear distinction between risk acceptance and residual exposure helps. Acceptance is a decision with an owner. Tolerance is a condition within which the work may continue. When the permit, risk assessment, and dashboard use those words differently, the organization can see where the actual decision is being made.

Executives should ask one simple question during review. Which evidence shows that the current exposure sits inside the stated tolerance? If the answer is only that the task is familiar, the team is trained, or the procedure exists, the organization is measuring intention rather than control health.

Question 3: Who can accept residual safety risk?

A risk appetite statement fails when everyone is expected to respect it but nobody owns the decision created by it. The authority should be explicit for each meaningful risk tier, and the authority should sit close enough to the work to understand the exposure while remaining senior enough to resolve resource and schedule conflicts.

The role does not have to be the most senior person in the company. It does have to be a role with authority to stop work, change the method, assign competent support, or delay production. An EHS specialist may identify the gap, but the operations leader who controls the work plan usually has to make the decision visible.

Ownership also needs a time limit. A temporary acceptance that is reviewed at every shift handover is not equivalent to an open-ended waiver that remains in a folder for months. The decision record should state the exposure, the missing or weakened control, the interim protection, the expiration point, and the condition that closes the exception.

The risk criteria used by the board and executive team should connect to field-level authority. Otherwise senior leaders approve thresholds in one language while supervisors manage exceptions in another.

Question 4: Does the appetite change resource decisions?

Safety risk appetite becomes real when it influences money, people, maintenance windows, engineering choices, contractor selection, and production plans. If the organization claims no appetite for a serious exposure but repeatedly defers the design change that would remove it, the operating system has revealed a different priority.

This does not mean every risk-control proposal receives immediate funding. It means the decision is visible and comparable. A capital request should explain the exposure, the control weakness, the time horizon, and the consequence of deferral. Leaders can then decide with the risk in view rather than allowing the issue to disappear inside a general backlog.

The same logic applies to staffing and competence. A task that requires two qualified people, an independent verifier, or a rescue capability cannot be treated as fully controlled when the roster makes those conditions impossible. The decision is not solved by asking the available worker to be more careful.

Use the health of the critical barrier as a resource signal. Repeated failed tests, overdue maintenance, unavailable isolation hardware, or weak field verification should trigger a management response before an incident forces the issue into view.

Question 5: Which signals force escalation before an incident?

Most weak statements describe what leaders will do after a serious event. Stronger statements define the signals that require action while the organization still has options. The signals may include a failed critical control, repeated temporary repairs, a pattern of overdue corrective actions, contractor mobilization without verified competence, or a work plan that depends on an untested emergency response.

These signals should be observable by the people who perform and supervise the work. A dashboard that only reports injury rates cannot show whether a barrier is becoming unreliable before harm occurs. A field review that records only completed observations can also create false reassurance if it does not test the quality of the control.

Escalation should have a destination and a response time. The question is not simply whether the issue is reported. The question is which leader must decide, what support is available, and what happens when the response does not arrive. The difference between governance review and routine assurance becomes important here because an unresolved exposure may need a decision, not another inspection.

Andreza Araujo book Safety Culture: From Theory to Practice is useful as a reminder that culture is seen in repeated decisions. A company does not demonstrate its appetite through a poster or policy alone. It demonstrates it through what happens when the signal is inconvenient.

Why zero appetite can create bad decisions

Leaders often use zero-risk language to communicate seriousness, but the phrase can become dangerous when it denies the existence of residual exposure. Workers then learn that the official answer is perfection, while the operational answer is to keep the work moving and avoid creating a record that proves the gap.

The better position is precise. An organization can have zero appetite for uncontrolled fatal exposure, deliberate bypass of a critical control, or work that proceeds without the authority required by its own process. It can also define the conditions under which controlled residual risk may be retained, reviewed, and reduced.

That precision protects reporting. People can raise a problem without pretending that every task is either perfectly safe or completely unacceptable. Leaders receive a decision they can act on, rather than a performance ritual that hides uncertainty.

How executives can test the statement in one review

A useful review does not start by editing the wording. It starts with a recent decision. Select one job involving high energy, confined space, lifting, process safety, or contractor exposure, then trace the decision from the stated appetite to the field authorization.

1. Identify the exposure that could cause serious harm.
2. List the controls that the organization says are non-negotiable.
3. Check the evidence that each control was present and effective.
4. Find the named person who accepted any remaining exposure.
5. Review the escalation path used when a control was unavailable.
6. Compare the decision with the resources and schedule actually provided.

If the statement cannot explain the decision, rewrite the governance rule around the decision rather than adding more aspirational language. A mature statement is short enough to remember and specific enough to change work.

What a credible safety risk appetite looks like

A credible safety risk appetite has five qualities. It names unacceptable exposure, distinguishes boundaries from tolerances, assigns decision authority, changes resource choices, and defines signals that trigger escalation. It also respects the difference between an approved residual risk and an uncontrolled gap that has been normalized.

ISO 31000:2018 provides the risk-management foundation, while ISO 45001:2018 connects that foundation to occupational health and safety leadership, worker participation, operational control, and performance evaluation. The standards do not remove the need for judgment. They make the judgment more visible and more disciplined.

Headline Podcast is built around conversations that make leadership decisions easier to examine. For safety leaders, the practical conclusion is direct. Do not ask whether the organization has a risk appetite statement. Ask which decision the statement changed this week, who had authority to make it, and what evidence proved that the boundary was respected.

A vague risk appetite lets each manager define acceptable safety risk locally, so the organization discovers its real boundary only after a failed control, an inspection, or an incident.