Content reviewed and verified by Graham Chee, with FCPA-led practice at Local Knowledge, Mascot NSW. Continuous CPA Australia member since 1986. Prior career at Goldman Sachs, BNP Investment Management and Merrill Lynch.. Last reviewed August 2026. Next review scheduled for November 2026.
TL;DR
Ensuring a more realistic and strategically sound approach to governance for Australian businesses.
Key Takeaways
- Confirmation Bias: The tendency to seek out, interpret, and remember information in a way that confirms one's existing beliefs or hypotheses. For example, a board might selectively consider data that supports a conservative risk stance, ignoring indicators of potential growth from calculated risks.
- Anchoring Bias: Over-reliance on the first piece of information encountered (the 'anchor') when making decisions. An initial, perhaps outdated, risk tolerance benchmark can unduly influence subsequent discussions, even if current market conditions or strategic objectives have shifted significantly.
- Groupthink: A psychological phenomenon where the desire for harmony or conformity in a group results in an irrational or dysfunctional decision-making outcome. This can lead to a board endorsing a RAS that no individual member truly believes in, simply to avoid conflict.
- Availability Heuristic: Overestimating the likelihood of events that are easily recalled or vivid in memory. Following a high-profile cyber-attack on an Australian entity, a board might disproportionately increase their risk aversion to cyber threats, even if other, more systemic risks are statistically more probable for their specific business model.
- Overconfidence Bias: An unwarranted belief in one's own abilities or judgment. Directors might mistakenly believe their past successes mean they are immune to certain risks, leading to an overly aggressive or inadequately resourced RAS, particularly concerning emerging risks not previously encountered.
Introduction: Beyond the Numbers – The Human Element in Risk
Why understanding cognitive biases is critical for robust risk governance
A board's formal risk appetite statement (RAS) is more than just a document; it's a strategic compass guiding decisions that protect and grow your enterprise. However, these crucial statements are often subtly distorted by inherent human biases, leading to misjudged risks and missed opportunities business advisory services. Graham Chee, FCPA, CPA, principal of Local Knowledge, writes from a practice that pairs FCPA-grade compliance with Goldman Sachs, BNP Investment Management and Merrill Lynch institutional experience, emphasising that identifying and mitigating these cognitive biases is paramount for Australian business owners and directors to ensure their RAS genuinely reflects their organisation's true risk posture and strategic intent.
Key Concepts: The Biases Lurking in Your Boardroom
Five cognitive biases that can warp your risk appetite statements
Confirmation Bias: The tendency to seek out, interpret, and remember information in a way that confirms one's existing beliefs or hypotheses. For example, a board might selectively consider data that supports a conservative risk stance, ignoring indicators of potential growth from calculated risks.
Anchoring Bias: Over-reliance on the first piece of information encountered (the 'anchor') when making decisions. An initial, perhaps outdated, risk tolerance benchmark can unduly influence subsequent discussions, even if current market conditions or strategic objectives have shifted significantly.
Groupthink: A psychological phenomenon where the desire for harmony or conformity in a group results in an irrational or dysfunctional decision-making outcome. This can lead to a board endorsing a RAS that no individual member truly believes in, simply to avoid conflict.
Availability Heuristic: Overestimating the likelihood of events that are easily recalled or vivid in memory. Following a high-profile cyber-attack on an Australian entity, a board might disproportionately increase their risk aversion to cyber threats, even if other, more systemic risks are statistically more probable for their specific business model.
Overconfidence Bias: An unwarranted belief in one's own abilities or judgment. Directors might mistakenly believe their past successes mean they are immune to certain risks, leading to an overly aggressive or inadequately resourced RAS, particularly concerning emerging risks not previously encountered.
Practical Application: Mitigating Bias in Your RAS
How this works in real business situations
Consider an Australian manufacturing firm looking to expand into a new overseas market. Without careful mitigation, confirmation bias might lead the board to focus only on market entry success stories, downplaying the significant geopolitical risks highlighted by DFAT's smartraveller.gov.au advisories or the complexities of foreign direct investment regulations. An expert principal-led approach would involve deliberately seeking out dissenting opinions and commissioning independent market analysis, rather than relying solely on internal projections. Similarly, when setting financial risk thresholds, anchoring bias could mean the board defaults to historical debt-to-equity ratios or cash flow targets, even if the AASB's updated accounting standards or ASIC's guidance on continuous disclosure for listed entities suggest a need for a more dynamic and forward-looking approach strategically sound approach to governance. An FCPA sign-off on every file ensures that such critical financial frameworks are rigorously evaluated against current standards and future strategic imperatives, rather than historical inertia. Our principal-led practice since 2003 has consistently guided boards to establish robust frameworks that counteract these inherent human tendencies, ensuring their RAS is a living, strategic document, not a relic of past thinking.
Recommended Steps: A Structured Approach to Bias Mitigation
Three key actions for your board
Promote Diverse Perspectives and Deliberate Dissent
Actively encourage diverse opinions and appoint a 'devil's advocate' during RAS reviews. This breaks groupthink and challenges confirmation bias. Ensure new board appointments bring varied industry experience or cultural backgrounds, broadening the collective viewpoint.
Establish Clear, Objective Metrics and Triggers
Define quantitative and qualitative risk thresholds with specific, measurable indicators. For instance, rather than 'moderate credit risk,' specify 'maximum 5% overdue accounts exceeding 90 days' or 'net debt to EBITDA not to exceed 2.5 times for more than two consecutive quarters.' This reduces anchoring bias and overconfidence by providing objective benchmarks.
Regularly Review and Recalibrate with External Input
Schedule annual or bi-annual deep dives into the RAS, incorporating external expert opinions. A fresh perspective from an independent FCPA or risk consultant can highlight biases that internal teams might miss. Reference current economic forecasts from the RBA and industry-specific risk reports from bodies like APRA or ASIC to ensure the RAS remains relevant and forward-looking, rather than reacting to recent, easily available events.
Common Questions: Navigating Risk Appetite Statements
What Australian business owners and directors ask us
Q.How often should our board review its Risk Appetite Statement?
A formal review should occur at least annually. However, significant changes in strategy, market conditions, or regulatory landscape (e.g., updates to Corporations Act 2001, Fair Work Act 2009, or new ASIC guidance) warrant an immediate reassessment. Think of it as a living document, not a set-and-forget policy.
Q.Can a small business board realistically implement these strategies?
Absolutely. While resources may differ, the principles remain. Even a board of two can consciously challenge assumptions and seek external, independent advice. The CPA Code of Ethics underscores the importance of objectivity, even in smaller entities.
Q.What's the biggest mistake boards make when developing a RAS?
The most common error is treating the RAS as a compliance exercise rather than a strategic tool. If it's not genuinely informing your business decisions and resource allocation, it's not fulfilling its purpose. Another significant mistake is failing to communicate the RAS effectively throughout the organisation, leading to misalignment.
Q.How do we ensure our RAS isn't just aspirational, but actionable?
Link your RAS directly to your strategic objectives and operational metrics. Translate broad statements into specific, measurable thresholds and key risk indicators (KRIs). This requires a robust risk management framework that monitors performance against these defined appetites, ensuring accountability and tangible action.
Q.Where can we find guidance on best practice for RAS in Australia?
ASIC provides guidance for listed entities, and APRA has detailed requirements for financial institutions. For broader governance, the ASX Corporate Governance Council's Principles and Recommendations offer valuable insights. However, for tailored advice specific to your entity's unique context, a principal-led expert consultation is invaluable.
Conclusion: Your Path to Clearer Risk Governance
Strengthening your strategic compass
The board's risk appetite statement is a cornerstone of effective governance. By understanding and actively mitigating the 'shadow play' of cognitive biases, Australian business owners and directors can elevate their RAS from a mere document to a powerful, realistic, and truly strategic asset. This proactive approach not only protects your enterprise but also empowers it to navigate uncertainty with greater confidence and precision. At Local Knowledge, our FCPA and CPA expertise, honed over decades, is dedicated to helping boards like yours craft risk frameworks that are as insightful as they are robust.
About the Author
Graham Chee, FCPA, CPA, GRCP, GRCA
Principal and Founder, Local Knowledge
Graham Chee is the principal and founder of Local Knowledge, an FCPA-led Australian practice that brings institutional-grade compliance, investment-structure and intellectual-property experience directly to owner-managed businesses. Graham is a Fellow of CPA Australia (FCPA since November 2005, continuous CPA member since 1986) and holds the OCEG Governance, Risk & Compliance Professional (GRCP) and Governance, Risk & Compliance Auditor (GRCA) designations. His prior career includes senior roles at Goldman Sachs, BNP Investment Management and Merrill Lynch. Graham was previously portfolio manager of the Asian Masters Fund (IPO December 2007 – 31 December 2009), which returned +29% in AUD terms versus the MSCI Asia Pacific (ex Japan) benchmark. He signs off on 100% of client files personally.
Areas of Expertise:
Industry-specific insights
This article is especially relevant to these industries. See how we tailor our services for each.
Get Personalized Advice - Contact Us Today
Every business situation is unique. Our team can provide tailored guidance for your specific needs, ensuring your risk appetite statements are strategically sound.
Graham Chee FCPA, CPA, GRCP, GRCA · Principal, Local Knowledge · Mascot NSW · CPA-signed files