Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Aligning Responses with Appetite and Tolerance
Aim for appetite, not zero
The goal of a response is residual risk within appetite. Spending more than that buys little extra value; spending less leaves the business carrying more risk than the board agreed to.
Sizing the response
Over- and under-treating
- Over-treating: costs exceed the benefit, and controls add friction and get bypassed.
- Under-treating: residual risk stays above appetite, and losses exceed what the board accepted.
Example. A low-risk internal wiki was put behind the same MFA, VPN and monitoring as the payment system. Staff started copying content to personal notes to avoid the hassle, creating a new risk. Scaling controls to the wiki’s actual risk fixed it.
Different appetites
| Risk type | Typical appetite |
|---|---|
| Customer data breach | Low |
| Safety of operational systems | Very low |
| Trying new technology in pilots | Moderate |
| Minor internal service outages | Moderate |
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Goal of a risk response | Residual risk within appetite |
| Residual still above appetite | Further response or escalation |
| After implementing a response | Re-assess residual risk |
| Most expensive control option | Not best unless it’s needed to reach appetite |
In short
- Responses aim to bring residual risk within appetite, not to eliminate risk.
- Over-treating wastes money and can slow the business; under-treating leaves risk above appetite.
- Check residual risk after the response, not just whether a control was added.
- If residual risk stays above appetite, respond further or escalate for formal acceptance.
- Appetite can differ by risk type; a low appetite for safety risk can sit alongside a higher one for innovation risk.
Exam traps
- Choosing the response that removes the most risk regardless of appetite or cost.
- Closing a risk once a control is added without re-rating residual risk.
- Applying one appetite level to every type of risk.
- Leaving risks above appetite without escalation.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Sizing the response
1 / 8