Chapter 6 of 13 · Weeks 3–6
Risk Appetite in Plain Words
- What is risk appetite, really?
- Who sets it, and who is allowed to accept a risk?
- How do I turn "low appetite" into something useful?
Risk appetite is the amount and type of risk an organisation is willing to take to reach its goals. It is set by leadership, often the board. It is not set by GRC. Your job is to help leaders say it clearly, then use it consistently.
Many appetite statements say something like "we have a low appetite for cyber risk." That sounds sensible and helps nobody. A risk owner cannot use it to decide whether to delay a launch or accept an unpatched server.
Make it usable
- Split it by area: customer data, availability of key services, regulatory standing, new technology.
- Give each area a boundary people can test, such as how long a key service may be down, or which data may never leave approved systems.
- Say who can accept risk at each level, and what must go higher.
- Say how long an accepted risk lasts before it must be reviewed again.
Appetite, tolerance and residual risk
Appetite is the overall stance. Tolerance is the specific line you will not cross in one area. Residual risk is what remains after your controls. When residual risk sits above the line, someone with the right authority must decide: add controls, accept it for a set time, transfer it, or stop the activity.
The question you might not ask out loud
A manager wants to accept a risk that looks far above our appetite. Can I refuse?
Usually you cannot refuse, but you can make sure the decision is made by the right person and written down. Explain the risk in plain terms, show where it sits against the appetite, and escalate if their authority does not cover it. Recording the decision honestly is your job; making it is theirs.
Rule of thumb:An accepted risk with no expiry date becomes permanent by accident. Every acceptance needs a review date and a named person.
Testing it
Take three real decisions from the last quarter, such as a delayed patch, a new supplier or a rushed launch. Would the appetite statement have told the owner what to do? If not, the statement needs work. Bring those examples to leadership; real cases change wording faster than theory.
Revisit appetite at least yearly and after a major change, such as an acquisition, a new market or a serious incident.