# data[].attributes.body
When documenting risks in a risk register and then on a heat map how should residual risk be appropriately reflected?

# data[].attributes.headline
Templates for development and review of risk appetite and tolerance

# data[].attributes.subject
Templates for development and review of risk appetite and tolerance

# data[].attributes.attachment_link.title
Guidance for development of risk appetite tolerance

# data[].attributes.headline
How does an organisation set its risk appetite and tolerance — and what’s the process?

# data[].attributes.subject
How does an organisation set its risk appetite and tolerance — and what’s the process?

# data[].attributes.body
Definitions:

Risk appetite = the amount and type of risk the organisation is willing to pursue or accept in pursuit of its objectives.

Risk tolerance = the acceptable deviation from that appetite — the specific thresholds or limits before action must be taken.

Process to establish them (common approach):

a) Board/Executive direction:
Risk appetite is owned by the Board and senior executives. They consider:

The organisation’s mission, stakeholders, and regulatory context.

What levels of risk are acceptable in various categories (e.g., zero appetite for safety breaches vs moderate appetite for innovation risk).

b) Develop a draft statement:
Risk management staff or advisors draft a risk appetite statement, often describing appetite by risk category (e.g., strategic, financial, operational, compliance, reputational, safety).

c) Workshop with leadership:
Facilitated discussions test the draft appetite against realistic scenarios. For example:

“Are we really prepared to tolerate a minor injury rate of X per year?”

“What does zero appetite for fatalities mean in terms of control systems and investments?”

d) Translate into operational tolerances:
This is where appetite becomes measurable tolerances, e.g.,

Maximum incident frequency rates,

Specific compliance breach limits,

Budget variance thresholds.

e) Formal approval and integration:
The Board approves the appetite and tolerance framework. It’s embedded in:

Risk registers (with risk ratings aligned to appetite),

Reporting dashboards (flagging breaches of tolerance),

Decision-making processes (new projects, control investments).

f) Ongoing review:
Appetite is reviewed regularly — annually, or if a major incident or change in strategy occurs.

# data[].attributes.headline
Reporting of OH&S risks — risk register vs routine operational reporting

# data[].attributes.subject
Reporting of OH&S risks — risk register vs routine operational reporting

# data[].attributes.body
How it’s typically handled:

OH&S risks absolutely belong on the risk register, especially significant workplace health and safety hazards that could lead to injury, breach of legislation, or reputational damage.

On a practical level, OH&S risks are often categorised under the “Operational” risk category on the register, because they arise from day-to-day operations and impact operational continuity.

However, serious or systemic OH&S risks (e.g., culture of non-compliance, repeated near misses, regulatory investigations) may also feature in higher-level strategic or compliance risk categories depending on your risk taxonomy.

Routine OH&S incidents (e.g., minor injuries, first aid treatments) are generally reported through incident registers, WHS committees, and line management as part of standard operational monitoring.

The risk register should record the key OH&S risks (e.g., ‘Risk of workplace injury due to inadequate hazard controls’), not every minor incident. Controls, treatment actions and residual risk ratings are tracked here.

Good practice:
The risk register should reflect the systemic WHS risks and link to:

routine WHS hazard registers and incident reports,

compliance monitoring with Work Health and Safety laws,

Board or executive reporting if the risk level is high.

# data[].attributes.body
1. Just wondering about the reporting of OH & S risks would this be a category on the risk register or as a matter of routine is reported as operational?

2. I am wondering how the organisation arrives at the appetite and the tolerance and what the process is for establishing this is?