Topics in this domain
- Exam Technique: Thinking Like a Risk Practitioner
- Aligning IT Risk Management with Business Strategy
- Organisational Structure, Roles and Decision Rights
- Risk Ownership and Accountability
- Segregation of Duties
- Risk Culture and Tone at the Top
- Ethics and Professional Conduct
- Policies, Standards, Procedures and Guidelines
- Policy Lifecycle, Exceptions and Enforcement
- Business Process Review: Ownership and Criticality
- Identifying and Valuing Organisational Assets
- Embedding Asset Management into Risk Governance
- Enterprise Risk Management: Purpose and Principles
- The Risk Practitioner's Role in ERM
- The Three Lines Model and Risk Oversight
- Risk Management Frameworks: ISO 31000, COSO ERM, NIST and COBIT
- Applying a Framework: the Risk Management Life Cycle
- Risk Appetite, Tolerance and Capacity
- Establishing and Maintaining the IT Risk Profile
- Making Risk-Based Business Decisions
- Legal, Regulatory and Contractual Requirements
- Connecting Governance to Risk Outcomes
Risk Appetite, Tolerance and Capacity
Three different ideas
- Risk capacity is the most risk the organisation could absorb before failing or breaking its obligations.
- Risk appetite is how much risk the board is willing to take to reach its goals, set well below capacity.
- Risk tolerance is the acceptable variation around a specific objective, usually a number.
Who sets what
| Concept | Set by | Example |
|---|---|---|
| Capacity | Determined by finances and obligations | Losses above 50 million would threaten solvency |
| Appetite | Board | Low appetite for customer data loss |
| Tolerance | Senior management, within appetite | No more than 4 hours’ outage of online banking |
From words to numbers
Example. “Low appetite for service disruption” becomes a tolerance of no outage of the payments platform over 2 hours, and a KRI that alerts when backup failover tests exceed 90 minutes.
Using appetite
- Evaluate each risk: is it within, near or beyond appetite?
- Choose responses that bring risk within appetite.
- Escalate risks beyond appetite to the right level for a decision.
- Report the risk profile against appetite to the board.
Review appetite when strategy, market conditions or capacity change.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who sets risk appetite | The board |
| Difference between appetite and tolerance | Overall willingness versus acceptable variation for a specific goal |
| Risk exceeds appetite | Respond further, or escalate for formal acceptance |
| MOST useful appetite statement | Specific and measurable |
In short
- Risk capacity is the most risk the organisation could absorb; appetite is how much it's willing to take; tolerance is the acceptable variation for a specific objective.
- The board sets risk appetite, normally well below capacity.
- Appetite must be turned into specific, measurable tolerances to be useful.
- KRI thresholds should warn before a tolerance is breached.
- Every risk response decision compares residual risk with appetite.
- Appetite is reviewed when strategy, conditions or capacity change.
Exam traps
- Confusing appetite (willingness) with capacity (ability).
- Letting IT or the risk function set the organisation's appetite.
- Writing appetite statements too vague to support decisions.
- Treating appetite as fixed forever.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Three different ideas
From words to numbers
Example'Low appetite for service disruption' becomes a tolerance of no outage of the payments platform over 2 hours, and a KRI that alerts when backup failover tests exceed 90 minutes.
1 / 8