Risk appetite
- Term
- Risk appetite
- Exam
- CISA & CISM
- Definition
The amount and type of risk an organization is willing to pursue or retain.
- Explained
Risk appetite is the board's statement of how much and what kind of risk the organization will pursue or retain in pursuit of its objectives. It anchors every treatment decision; risks above appetite must be treated or escalated for explicit acceptance at the right level.
- In practice
The board states it will not accept risks that could cause regulatory fines.
- Often confused with
- Risk tolerance
- Exam angle
Set by senior management and the board.
- Related