Every regulated financial institution has a risk appetite statement, reviewed and approved annually by the board. In my experience reviewing these documents across many institutions, very few of the people making day-to-day risk decisions could describe what the statement actually says, in specific terms, without looking it up.
This isn't necessarily a failure of the document — many risk appetite statements are reasonably well written. It's a failure of translation between the statement and the decisions it's meant to govern. A statement that says the institution has 'moderate appetite for operational risk in emerging technology' doesn't tell a specific team, considering a specific technology decision next Tuesday, what threshold actually applies to their situation.
The institutions that get more value from their risk appetite statements are the ones that translate the statement into decision-specific guidance for the teams that actually need it — not replacing the board-level statement, but building a bridge between its abstractions and the concrete decisions teams face regularly.
Without this bridge, risk appetite statements function as a governance artifact satisfying a regulatory expectation, while the actual risk decisions get made based on team-level judgment, precedent, and whoever's most senior in the room — which may or may not align with what the board actually approved.
A useful test: pick any team making meaningful risk decisions and ask them, without warning, to describe the specific appetite threshold that applies to their next major decision. If they can't answer specifically, the statement isn't governing anything yet — it's just a document the board has approved.