Risk Appetite

Risk appetite is the amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It defines the boundary between acceptable and unacceptable risk, providing a benchmark against which residual risks are evaluated.

Risk appetite is typically defined by the board and expressed through both qualitative statements and quantitative metrics. It varies by risk category — an organization may have a low appetite for compliance risk but a higher appetite for strategic risk. Risk appetite is operationalized through risk thresholds and tolerances — specific metrics that trigger action when exceeded. When residual risk exceeds risk appetite, the organization must either treat the risk (add controls, transfer, avoid) or formally accept it with documented approval.