Risk Appetite Without Metrics or Tolerances
A six-hospital specialty network with $1.2 billion in revenue approved a risk appetite statement last year: moderate appetite for patient safety, low for regulatory compliance, and high for growth. The statement has no metrics, tolerances, or escalation triggers. To fund a $40 million digital front-door program, management proposes cutting infection-prevention staffing by 12% and delaying a ventilation upgrade in two older operating suites. The enterprise risk register still rates patient safety as medium, with no change in likelihood or impact. The board dashboard reports only the number of sentinel events, which is zero year-to-date. The audit committee asks internal audit whether risk appetite is being operationalized. Management says the staffing cut is within moderate. Internal audit has not previously reviewed risk appetite.
1. Assess whether the risk appetite statement and management’s use of it provide a sound basis for decision-making. Identify specific deficiencies.
Read the worked answer
The statement is not operational. Moderate, low, and high are undefined, so management can label almost any decision consistent with appetite. There are no metrics, thresholds, or escalation rules tying patient safety to infection rates, staffing ratios, ventilation standards, or near-miss trends. The risk register was not updated after a material staffing and infrastructure decision, which suggests the decision was not run through the ERM process. The board dashboard uses only sentinel events, a lagging and low-frequency measure that can stay at zero while risk rises. The statement also creates a false trade-off: patient safety is not a growth lever, and low regulatory appetite should trigger scrutiny of staffing cuts that may affect licensure. Management’s assertion that the cut is within moderate is unsupported because no boundary exists. Internal audit should treat this as a risk appetite design and operating deficiency, not merely a documentation gap.
2. Design an assurance engagement to test whether risk appetite is operating as intended. Include procedures, evidence, and population.
Read the worked answer
The engagement objective should be to determine whether board-approved risk appetite is translated into decision criteria and used. Procedures should include reviewing the statement, board minutes, capital allocation policy, and risk register; interviewing the CRO, CFO, CNO, and infection-prevention lead; and tracing major decisions against appetite. The population should be all board or executive decisions above a defined threshold in the past 12 months, including the digital program and staffing cut. For each decision, internal audit should obtain the decision paper, risk assessment, alternatives considered, and evidence of escalation. Internal audit should independently compare infection-prevention staffing and ventilation status to the stated patient safety appetite and test whether the dashboard captures leading indicators. Evidence should include staffing rosters, maintenance records, incident and near-miss data, and board reporting packs. The conclusion should state whether appetite is defined with measurable tolerances and whether decisions are demonstrably constrained by it.
3. What should internal audit report if management cannot demonstrate the cut is within appetite?
Read the worked answer
Internal audit should report a significant deficiency: risk appetite is not operationalized, and management cannot evidence that a material patient-safety decision is within board-approved tolerance. The report should avoid accepting the label moderate as evidence. It should state that the board has not set measurable boundaries, the risk register was not updated, and the dashboard is insufficient to detect deterioration. Recommendations should include defining quantitative appetite and tolerance for patient safety, requiring decision papers to cite appetite and escalation thresholds, updating the register before approving material cuts, adding leading indicators such as infection-prevention staffing ratios and ventilation compliance, and requiring board or committee approval for decisions that approach tolerance. Internal audit should also recommend a retrospective review of the staffing cut and ventilation delay, with a follow-up engagement to test whether the new framework changes decisions.