The Risk Appetite Statement is a formal written document, approved by Internal Audit, that should be informed by the organisation's risk capacity

The Risk Appetite Statement is indeed a formal written document that is approved by the Internal Audit. However, it's important to note that it should not just be informed by the organization's risk capacity, but also by its risk tolerance and risk profile.

Here are the steps to create a Risk Appetite Statement:

1. Identify Risks: The first step is to identify the various risks that the organization might face. This could be anything from financial risks, operational risks, strategic risks, etc.

2. Assess Risk Capacity: The next step is to assess the organization's risk capacity. This is the maximum amount of risk that the organization can take on at any given point in time.

3. Determine Risk Tolerance: After assessing the risk capacity, the next step is to determine the organization's risk tolerance. This is the amount of risk that the organization is willing to accept in pursuit of its objectives.

4. Develop Risk Appetite: Based on the risk capacity and risk tolerance, the organization can then develop its risk appetite. This is the amount of risk that the organization is willing to seek or accept in order to achieve its long-term objectives.

5. Write the Risk Appetite Statement: The final step is to write the Risk Appetite Statement. This should clearly articulate the organization's risk appetite, and be approved by the Internal Audit.

6. Review and Update: The Risk Appetite Statement should be regularly reviewed and updated to ensure that it remains relevant and aligned with the organization's objectives and changing risk landscape.