Risk appetite.

What risk appetite is for

Risk appetite exists to settle an argument before it happens. Every treatment decision, every "do we fix this or live with it", is really a question about how much risk the organisation is prepared to carry against the reward of pursuing its objectives. If that boundary lives only in the heads of the people running the programme, then each decision becomes a private judgement that nobody else signed, and that is exactly what an auditor or a board challenge will pull apart. A written appetite, owned at executive or board level, turns those scattered judgements into a stated organisational position. It is a steering instrument, not paperwork: it tells the risk team where they may proceed on their own authority and where a risk has to be escalated.

Crucially, appetite is set in the language of objectives, not as a single number. An organisation chasing aggressive growth in a new market will rationally accept more strategic and operational risk than one whose mandate is to protect a regulated, life-critical service. The board decides how much it is willing to expose to meet what it is trying to achieve. That is why appetite cannot be delegated to the security or risk function to invent on its own: it is a statement of intent that only the people accountable for the objectives can legitimately make.

Appetite versus tolerance versus capacity

These three are constantly confused, and the confusion is expensive. Appetite is how much risk you want to take in pursuit of objectives. Tolerance is the deviation you are willing to live with around that appetite before you act, the practical band on either side of the target. Capacity is the absolute maximum the organisation could absorb before its viability is threatened, regardless of what it wants. You set appetite below capacity on purpose, leaving headroom, and you express tolerance so that day-to-day variation does not trigger a crisis meeting every time.

How it shows up in the standards

In ISO 31000, risk appetite is part of the framework leadership establishes when it commits to managing risk: top management and oversight bodies are expected to define and communicate how much risk the organisation is prepared to take. ISO 27005 and the ISO 27001 information security management system rely on the same idea through risk criteria: before you can evaluate a risk, you need agreed criteria for what is acceptable, and those criteria are appetite made operational. The appetite is upstream of evaluation, and the criteria are how it gets applied consistently to each risk.

Appetite is not a poster on the wall. It only earns its keep when it is wired into the rest of the cycle. The risk evaluation step compares each analysed risk against the appetite-derived criteria to decide whether action is needed. The risk treatment decision, avoid, reduce, transfer or accept, is justified by reference to it: a risk accepted within appetite needs only a documented, authorised acceptance, while a risk above appetite demands treatment or formal, escalated sign-off. The risk register records where each entry sits relative to the appetite and who accepted what. When auditors find treatment decisions that nobody can trace back to a stated appetite, that is the gap that unravels the whole evaluation.

Practically, appetite is reviewed, not carved in stone. It is revisited as objectives change, after major incidents, and through management review, because an appetite set for last year's strategy quietly misdirects this year's decisions. The discipline is to keep it explicit, keep it owned at the top, and keep it connected to the criteria the team actually uses.