Risk appetite: how much risk your organisation will accept
Risk appetite is the level and type of risk an organisation is willing to accept in pursuit of its objectives, set by leadership and used to judge whether a residual risk needs further treatment. ISO 27001, ISO 42001 and most other frameworks expect a documented risk appetite that drives risk treatment decisions.
What risk appetite looks like in practice
Risk appetite can be a qualitative statement ("we do not accept any risk rated critical") or a quantitative threshold ("we accept up to $500K annualised loss from any single risk"). Most compliance programmes use a matrix: risks that fall above a defined line need further treatment; those below it are accepted with a named owner.
Risk appetite is not the same as risk tolerance, though the terms are often used interchangeably. Some standards distinguish appetite (how much risk you want to take) from tolerance (how much variation around that you will accept).
What auditors check
Auditors want to see a documented risk appetite statement approved by leadership, risk treatment decisions that reference it, and evidence that risks above appetite have been escalated. They also check that the appetite is reviewed when the business changes.
- Documented risk appetite statement
- Approval by leadership or the board
- Risk treatment decisions that reference the appetite
- Escalation of risks that exceed the appetite
- Review at management review or after significant change
Setting risk appetite in Certifyi
In Certifyi, risk appetite is set on the risk register and reflected on the heatmap. Risks above the appetite line are flagged and require documented acceptance or further treatment.
- Residual risk: the risk compared to the appetite.
- Risk management software: register, heatmaps and control linkage.
- Management review: where appetite is reviewed.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them