Risk Appetite Statement Lab
The board has to answer one deceptively hard question: how much cyber risk will we accept in pursuit of our objectives? Sit on the risk committee and set a board-approved cyber risk appetite — keep appetite distinct from tolerance, express it by category, pair plain-language stances with measurable thresholds, and anchor every accept / mitigate / transfer / avoid call to the line. Then face the hard ones: a risk that lands above appetite, two business lines handed the same appetite, and an acceptance recorded with no rationale or expiry. Each decision shows you why.
Pair this drill with the free Board Cyber Risk Appetite Statement — the document that records the appetite you practise setting here. Educational drill, not legal advice.
The real job. More noise, a tighter clock.
You sit on the risk committee of a company setting its first board-approved cyber risk appetite. Work 10 board-room decisions — make the call a board, a regulator and an auditor would find defensible, then see why. You are graded on how many you get right against the clock.
What this lab is
- A free, browser-based decision drill on setting a board-approved cyber risk appetite: work ~14 board-room decisions about how much cyber risk to accept, where to draw the accept/mitigate/transfer/avoid lines, and how to handle a risk that exceeds appetite.
- Appetite is how much risk the board will accept in pursuit of objectives; tolerance is the allowable variation around it before escalation — the drill keeps the two distinct.
- You practise the real traps: an appetite so vague it blocks nothing, mixing qualitative stances with quantitative thresholds, differing appetite by business line, reconciling an over-appetite risk, and recording a formal, time-bound board acceptance.
- Each decision reveals why the board-defensible answer is right, and you are graded S–D on how many you call correctly against the clock.
- Educational decision drill — not legal or risk-management advice. Pair it with the free Board Cyber Risk Appetite Statement template.
Frequently asked questions
What is the Risk Appetite Statement Lab?
A free, in-browser decision simulation that puts you on a company’s risk committee as it sets its first board-approved cyber risk appetite. You work through board-room decisions — what appetite means, how to express it by category, where to draw accept/mitigate/transfer/avoid lines, and what to do when a risk exceeds appetite — and each one has a single board-defensible answer, revealed after you lock in your call.
What is the difference between risk appetite and risk tolerance?
Appetite is the amount of cyber risk the board is willing to accept in pursuit of the organisation’s objectives — a forward-looking choice. Tolerance is the acceptable variation around that appetite before escalation is triggered — the guardrail. Breaching tolerance is the signal that management must bring the risk back to the board.
Is this legal advice?
No. The lab is an educational drill. Governance concepts (appetite vs tolerance, treatment decisions, board acceptance of exceptions) are summarised for orientation and should be applied to your specific facts with qualified counsel and your risk function.
Who is it for?
CISOs, risk officers, general counsel, CFOs, risk-committee members and board directors — anyone who sets, approves or operates within a cyber risk appetite and wants to rehearse the decisions before the statement is real.