Risk Appetite: Definition and How to Set It
Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its business objectives. It's set at the top — board or senior management — and is the explicit threshold risk managers use to decide which risks need further mitigation and which can be accepted as-is.
Risk Appetite vs Risk Tolerance
The two are related but not identical:
- Risk appetite is strategic — the broad level of risk you're willing to take overall or by category (cyber, financial, operational).
- Risk tolerance is operational — the specific limits for a given risk type or metric. E.g., downtime tolerance is 4 hours a year for critical systems.
Auditors expect both: an appetite statement at the top, tolerances cascading down to specific operational limits.
Where It Lives
A typical risk appetite statement sits in:
- The enterprise risk management policy (board-approved).
- The information security policy (summary form).
- The risk register (as the threshold line that separates "treat" from "accept").
The appetite statement itself is usually one page. A two-sentence appetite statement is a red flag.
Example Risk Appetite Statements
- "We have low appetite for cybersecurity risks that could result in regulated-data breach, customer-impacting outages, or reputational harm with named customers. We have moderate appetite for risks associated with innovation, new product launches, and early-stage markets."
- "We accept no risks that could materially breach regulatory obligations. We accept moderate operational risks where mitigation cost exceeds expected loss."
How It's Used
Every entry in your risk register has a residual rating. If residual is above appetite, you must treat (reduce the risk further) or escalate the acceptance to the risk owner. Appetite is the line that turns risk management from theatre into practice.
See residual risk for how to measure what's left after controls, and risk treatment plan for what to do when residual exceeds appetite.
What Auditors Check
- Board approval of appetite statement, with a date.
- Appetite statement referenced in the risk register — not just filed.
- Risks above appetite have a treatment plan or explicit acceptance.
- Appetite is reviewed at least annually.