What Does Your Risk Appetite Measure Actually Mean?

A percentage can conceal two different questions

The report says overdue actions are down from twelve percent to eight percent. The team welcomes the improvement. During preparation of the next pack, someone discovers that one month divided overdue actions by all actions and the other divided them by actions due. The numbers are arithmetically possible. The comparison is not yet meaningful.

This problem can survive a polished dashboard because the label stays the same while the definition changes underneath it. The chart does not reveal which records were included, how cancelled items were handled or when the data was extracted. A short metric name is useful for navigation, but it is not a complete specification.

Before asking AI to explain the movement, ask it to reconcile the definitions. Supply the metric specification, calculation notes and relevant reporting extracts. The output should show what the measure counts, where the definition comes from and which conflicts require a decision. Do not ask the model to select whichever interpretation produces the clearest trend.

This article concerns the operational definition of a measure. It does not set risk appetite, propose tolerance thresholds or determine whether an organisation has breached its obligations. Those judgements require the applicable governance arrangements and approved criteria. Making the input clearer supports the decision without transferring authority to the drafting tool.

Separate the measure from the appetite decision

A measure describes something observable under a defined method. An appetite statement expresses the organisation's position on risk. A threshold or tolerance may connect the two, but that relationship must come from the approved framework. It cannot be reconstructed from historical dashboard colours or the distribution of recent values.

For example, the fact that a report has always coloured eight percent green does not establish that eight percent is an approved limit. The colour may reflect a local spreadsheet rule, an old decision or a configuration error. Record the source of the threshold separately from the source of the calculation.

Keep the definition sheet explicit about what it cannot answer. A metric counting open actions may say little about their severity, age or significance. A training-completion rate may not establish competence. A count of reported incidents may depend on reporting behaviour as well as underlying events. These are interpretive questions to consider, not automatic explanations of any particular result.

The ABS's national accounts methodology explains why concepts, definitions and methods help readers interpret data. That principle is relevant by analogy here. It does not make the fictional measures in this article official statistical standards or validate their use as risk indicators. Source: ABS

Assemble a definition pack with visible conflicts

Collect the approved metric description, the workbook calculation and the report label as separate source items. Include the effective date of each. If a procedure and a spreadsheet disagree, preserve both versions. Combining them into a single cleaned paragraph before review can erase the very conflict the exercise needs to resolve.

Ask for the population boundary first. Which entities, teams, systems or records are eligible? Then specify the event or condition being counted. A numerator is not simply "overdue items" if overdue depends on a date rule, an exclusion or a status that changes after the reporting cut-off.

Write the denominator in full. "Total" is rarely enough. It could mean all records ever created, records active at month end, records due during the month or people assigned a requirement. Also state how a zero denominator is represented. A missing result must not be silently reported as zero risk.

The pack should identify the intended reader and decision. A measure used to allocate follow-up work may need different detail from a board-level trend. That does not permit the same label to change meaning between reports. It means the owner must define the relationship between the detailed operational measure and the summary presented elsewhere.

Three constructed measures expose the problem

Consider a fictional private-sector service organisation preparing a monthly risk pack. It supplies three measures, each with conflicting documentation. The quantities are constructed for teaching. They are not benchmarks, appetite settings or results from a real organisation. No model run is claimed; the reconciled outputs illustrate the expected method.

Measure M1 is labelled "Overdue actions". The workbook has eight overdue actions and one hundred actions in its master register, producing eight percent. A procedure describes the denominator as actions due by month end. The constructed due population contains forty actions, which would produce twenty percent if the same eight belong to that population.

The correct drafting response is not to replace eight percent with twenty percent. The model first records the competing definitions and asks the owner to confirm population membership and the governing specification. Both calculations can be shown as illustrations, but neither becomes the approved report until the conflict is resolved.

Measure M2 is labelled "Training completion". Its workbook shows ninety completed assignments from a roster of one hundred and twenty people, producing seventy-five percent. A supplied note says the requirement applies only to one hundred assigned people. If all ninety completions belong to those assignments, the alternative calculation is ninety percent.

Again, the owner must establish eligibility and the relationship between people and assignments. One person may have more than one assignment in another workflow. A measure counting completed assignments cannot be divided by people merely because the numbers happen to look plausible. The definition must specify the unit of observation before the calculation is accepted.

Measure M3 is labelled "September incidents". One file counts six reports received during September. Another note describes incidents occurring during September and lists four. Some reports concern earlier events. Neither count is inherently wrong, but they describe different time bases. The label must state which event date controls inclusion.

The proposed review pack presents these three conflicts side by side with source references and owner questions. It does not apply traffic-light colours. Until the definition and applicable threshold are confirmed, a coloured result would imply a judgement the exercise has not established. The absence of a colour is an honest expression of the current evidence state.

Use AI as a definition comparator

Give the model a bounded extraction task. Ask it to identify the population, numerator, denominator, time basis, exclusions, source system, formula and owner from the supplied material. For each field, require a source reference or an explicit unknown. A fluent definition with no source is not an acceptable completion.

Then ask it to compare those extracted fields across documents. Differences should be described precisely: master register versus due population, people versus assignments, received date versus occurrence date. Avoid a generic label such as inconsistent data when the specific mismatch is known. The owner needs a question they can resolve.

Require the model to preserve the original values and labels in a separate column. Proposed labels belong beside them, not over them. This gives the reviewer a way to assess whether the rewrite clarifies the meaning or changes it. It also preserves an audit trail for revisions to a reporting pack.

Do not ask the model to infer missing thresholds from a familiar industry framework. If the approved threshold is absent, record it as absent. If an appetite document is supplied but its applicability is unclear, identify the relevant passage and ask the governance owner to confirm the relationship. The tool is organising evidence, not exercising delegated authority.

Reconcile arithmetic after agreeing the definition

Once the owner confirms a definition, trace the calculation from the selected population. Count the included records, apply the stated rule and reproduce the result independently. Keep a record of exclusions and their reasons. A correct formula applied to the wrong population remains an incorrect implementation of the measure.

For M1, an approved due-population denominator would require confirming that all eight overdue actions are among the forty eligible actions. If one belongs to an excluded category, both the numerator and the explanation may change. The illustrative twenty percent calculation is conditional on that membership check, not a substitute for it.

For M2, confirm whether completion is measured at a point in time or during a period. Someone completing training after the cut-off might belong in the next report. If the roster changes during the month, define how joiners and leavers are treated. Do not let the model choose a convention simply to make monthly comparisons convenient.

For M3, consider whether the report needs both received-date and occurrence-date views. That is an owner decision about usefulness. If both are retained, give them distinct labels and explain their relationship. Adding them together would double-count overlapping events, so the report must not imply that they are independent categories.

Make changes visible to the reader

A corrected definition can create a break in the series. Do not present a new-method result as a like-for-like improvement over an old-method result. Record the effective date and explain which component changed. Where historical recalculation is feasible and authorised, retain the original series alongside the restated version.

If historical source records are unavailable, say so. The team can begin a consistent series from the change date without manufacturing earlier values. A note about non-comparability may be less visually attractive than a continuous trend, but it protects the reader from drawing a conclusion the data cannot support.

Keep the approval record for the change separate from the technical calculation check. The analyst may demonstrate that the workbook implements the new definition correctly. The accountable owner still approves the definition and its intended use. Neither action establishes that the appetite statement itself should change.

Internal audit's information-quality and documentation requirements offer a relevant discipline when these measures enter an engagement. The IIA standards do not prescribe the fictional formulas here. Standard 14.6 of the IIA's Global Internal Audit Standards requires internal auditors to document engagement work well enough for another informed, competent person to repeat it and reach the same results. For these measures, that means retaining the source records and calculation steps behind each reported figure. Source: IIA

Give the owner a short decision pack

The useful handover contains the current label, the competing definitions, the affected result and a specific decision request. Include the sources that produced the conflict. Do not bury the question beneath a long AI-generated explanation of risk management. The owner needs to know what must be decided and what depends on it.

Distinguish a definition decision from a data correction. The owner may confirm that the procedure is correct and the workbook is wrong. Alternatively, the procedure may be outdated. Those outcomes require different changes, even if they eventually produce the same reported number. Record the reason rather than only the replacement value.

Name the downstream outputs affected by the change. A board pack, operational dashboard and assurance paper may all reuse the measure. Correcting one workbook does not ensure that every copied chart is updated. The review pack should identify the known dependencies and leave unconfirmed ones visible for follow-up.

For unresolved issues, state the permitted interim use. A metric with a disputed denominator might still support a count of items requiring attention, but not a percentage trend. That limitation needs an owner decision and clear labelling. The model must not create an interim reporting policy on its own.

Review meaning before explaining movement

At the next reporting cycle, check whether the definition, source population or calculation changed before writing a narrative about the result. A movement can reflect operational change, a revised method, corrected data or a combination. The explanation must follow the evidence available for that reporting period.

Start with one consequential measure whose name hides uncertainty. Build its definition sheet, reproduce its calculation and resolve the owner questions. Only then ask AI to help draft a reader-facing explanation. A risk report becomes more useful when people can explain what the measure means before debating whether its colour is acceptable.

Reusable materials

Metric-definition review pack

All figures are constructed. No appetite threshold is proposed.

Proposed labels, conditional on confirmation

• M1: Overdue actions as a proportion of actions due by month end.
• M2: Completion among eligible assigned people at the reporting cut-off, only if one assignment per person is confirmed.
• M3: Reports received during September, or events occurring during September, as separate views.

Definition sheet

Prompt

Compare only the supplied metric descriptions, calculation notes and reporting extracts.
Extract population, unit of observation, numerator, denominator, period, exclusions, formula, source and owner. Cite the supplied source ID for each field; absent evidence is UNKNOWN.
Preserve original labels and values. Show proposed clarified labels separately. Identify conflicts and frame specific owner questions.
Do not invent thresholds, decide appetite, colour results, assume population membership or treat people as assignments. Conditional arithmetic must state its conditions.
Exclude confidential records and personal data; use the constructed aggregate examples supplied.
Return a human-review pack, not an approved metric or a finding. Do not modify reports or send communications.

Acceptance checks

• Recompute the four illustrative percentages independently.
• Keep M3 as two overlapping time-based views, not a sum.
• Preserve unresolved definitions and separate threshold authority.
• Record any approved change and assess comparability before describing a trend.

Related reading

• Board AI Literacy Is Now a Control Expectation, Not a Training Nice-to-Have
• Build a Data Dictionary for a Spreadsheet You Inherited

References

1. Australian Bureau of Statistics, Australian System of National Accounts: Concepts, Sources and Methods, Edition 8, Chapter 24 Quality of the National Accounts, released 20 January 2026, paragraphs 24.83 to 24.85: https://www.abs.gov.au/book/export/46789/print
2. The Institute of Internal Auditors, Global Internal Audit Standards, condensed edition, issued 9 January 2024 and effective 9 January 2025, Standards 14.1 and 14.6: https://www.theiia.org/globalassets/site/standards/condensedglobalinternalauditstandards_2024january9_printable.pdf