Topics in this domain
- Risk Management Concepts and Frameworks
- Inherent Risk, Residual Risk, Appetite and Tolerance
- Threat Actors, Motivations and Attack Vectors
- The Evolving Threat Landscape: AI, Cloud and Supply Chain
- Threat Modelling and Cyber Threat Intelligence
- Vulnerability Assessment and Scanning
- Control Deficiencies and Security Gap Analysis
- The Risk Assessment Process
- Qualitative Risk Analysis: Likelihood and Impact
- Quantitative Risk Analysis: SLE, ALE and Loss Estimation
- Risk Scenarios and Prioritisation
- Risk Treatment Options: Mitigate, Transfer, Avoid, Accept
- Risk Acceptance: Approval, Expiry and Review
- Cost-Benefit Analysis for Risk Treatment
- Risk Ownership vs Control Ownership
- RACI and Risk Escalation Paths
- The Risk Register
- Continuous Risk Monitoring and Key Risk Indicators
- Risk Reporting to Executives and the Board
- Integrating Risk Management into Business and IT Processes
Inherent Risk, Residual Risk, Appetite and Tolerance
Before and after controls
- Inherent risk is the risk before any controls: how bad things would be if nothing were in place.
- Controls reduce the likelihood or the impact.
- Residual risk is what remains. It’s never zero.
Residual risk is compared with the organisation’s appetite. If it’s within appetite, the risk owner formally accepts it. If not, more treatment is needed, or acceptance at a higher level.
Capacity, appetite and tolerance
| Term | Meaning | Set by |
|---|---|---|
| Risk capacity | The most risk the organisation could take before failing or breaking obligations | Reality: finances, law |
| Risk appetite | How much risk the organisation is willing to take to pursue its objectives | Board / senior management |
| Risk tolerance | Acceptable variation around a specific objective, often a number | Management, within appetite |
| Residual risk | Risk remaining after controls | Measured; accepted by the owner |
Writing appetite down
A vague attitude doesn’t help anyone decide. Good appetite statements give usable thresholds:
| Vague | Usable appetite statement |
|---|---|
| “We take security seriously.” | “No more than 4 hours of unplanned downtime for payment systems per year.” |
| “Protect customer data.” | “Zero tolerance for unencrypted customer data on portable devices.” |
| “Moderate risk is fine.” | “Residual risks rated High need executive acceptance and quarterly review.” |
| “Innovate safely.” | “Moderate appetite for cloud and AI pilots using non-sensitive data.” |
Using the yardstick
| Residual risk is… | What happens |
|---|---|
| Above appetite | Treat further, or escalate for acceptance at a higher level |
| Within appetite | The owner accepts it; it’s monitored and reviewed when things change |
| Far below appetite | Possibly over-controlled; money could be freed for other risks |
| No appetite defined | Nobody can judge whether controls are enough; raise it with management |
Example. A hospital’s appetite allows no loss of patient record availability longer than 8 hours. The new records system’s residual risk shows a 24-hour restore time. The CISO escalates, and the board funds a standby site rather than accept the gap.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who sets risk appetite? | The board / senior management |
| Risk remaining after controls | Residual risk |
| Goal of risk treatment | Residual risk within appetite |
| Residual risk exceeds appetite | Further treatment, or escalation for acceptance |
| Acceptable variation around one objective | Risk tolerance |
In short
- Inherent risk is the risk before controls; residual risk is what remains after them.
- Risk appetite is the amount of risk the organisation is willing to take to pursue its objectives; the board sets it.
- Risk tolerance is the acceptable variation around a specific objective; risk capacity is the most risk the organisation could survive.
- Treatment aims to bring residual risk within appetite, at reasonable cost, not to reduce it to zero.
- Residual risk must be formally accepted by the risk owner, at a level of authority matching its size.
- Appetite statements turn a vague attitude into usable thresholds, such as 'no more than 4 hours downtime for payments'.
Exam traps
- Appetite is set by the board and senior management, not by the CISO.
- If residual risk exceeds appetite, more treatment or higher-level acceptance is needed; doing nothing isn't an option.
- Risk tolerance is narrower and more specific than appetite.
- Controls that push residual risk far below appetite may be wasting money.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Before and after controls
Capacity, appetite, tolerance
1 / 9