Topics in this domain
- IT Governance vs. IT Management
- Board and Senior Management Roles
- IT Steering Committee
- IT Strategy and Business Alignment
- Balanced Scorecard
- COBIT
- ITIL
- ISO 27001/27002
- COSO: ERM and Internal Control
- Policies, Standards, Procedures, Guidelines
- IT Organizational Structure and Key Roles
- Segregation of Duties in IT
- Enterprise Architecture (Zachman, TOGAF)
- Risk Management Process
- Qualitative vs. Quantitative Risk Assessment
- Risk Responses: Mitigate, Transfer, Avoid, Accept
- Risk Appetite and Residual Risk
- Maturity Models (CMMI)
- KPIs and KGIs
- Outsourcing: Benefits and Risks
- Vendor Selection, Contracts, SLAs, Right to Audit
- Cloud and Offshore Governance
- Portfolio and Resource Management
- HR: Hiring, Training, Termination
- Legal and Regulatory Compliance
- Quality Management
Risk Appetite and Residual Risk
How much risk is OK?
No organisation can remove all risk; doing business means taking some. The question is how much is acceptable.
Think of a family choosing how to invest their savings. Young savers might accept big ups and downs for bigger returns. A family about to retire wants safety. Neither is wrong: it depends on their goals and what they could afford to lose. Organisations make the same kind of choice, and it’s called risk appetite.
Capacity, appetite, tolerance
| Term | Meaning | Set by |
|---|---|---|
| Risk capacity | The most risk the organisation could bear without failing | A fact about its resources |
| Risk appetite | How much and what kinds of risk the organisation is willing to take to reach its goals | The board |
| Risk tolerance | Acceptable variation for specific goals, often a measurable limit | Management, within appetite |
Appetite is broad (“we have a low appetite for risks to customer data”). Tolerances make it measurable (“no more than one reportable breach a year”, “critical systems back within four hours”).
Inherent and residual risk
- Inherent risk: the risk before any controls.
- Residual risk: what’s left after controls.
Controls never remove risk completely. The aim is to bring residual risk within appetite, where the risk owner formally accepts it. Spending more to push risk even lower is usually poor value.
The auditor’s yardstick
When judging controls, the auditor compares residual risk with the organisation’s appetite:
- Within appetite: the controls are adequate, even if they aren’t “best practice”.
- Above appetite: report it. Management must treat it further, or someone with enough authority must accept it.
- Far below appetite: the area may be over-controlled, which is a chance to save money.
Without a defined appetite, nobody (including the auditor) can tell whether controls are enough. That gap is worth reporting in itself.
Example. The board’s appetite statement says outages of customer-facing systems over four hours are unacceptable. Online banking has no backup site, and restore tests take 18 hours. Residual risk is clearly above appetite, so the auditor reports it to management and the audit committee.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who sets risk appetite? | The board |
| The risk remaining after controls | Residual risk |
| The goal of controls | Reduce residual risk to an acceptable level (within appetite) |
| Residual risk exceeds appetite | Further treatment, or acceptance at a higher level |
| Difference between appetite and tolerance | Appetite is overall; tolerance is acceptable variation for specific goals |
In short
- Risk appetite is how much risk the organisation is willing to take to achieve its goals. The board sets it.
- Risk tolerance is the acceptable variation around specific goals; risk capacity is the most risk the organisation could bear.
- Inherent risk is the risk before controls; residual risk is what's left after controls.
- Residual risk should be within appetite and formally accepted by the risk owner.
- Residual risk is never zero; the aim is an acceptable level.
- The auditor uses appetite as the yardstick when judging whether controls are adequate.
Exam traps
- Controls aim for acceptable residual risk, not zero risk.
- Appetite is set by the board, not by IT or the CISO.
- If residual risk is above appetite, more treatment or higher-level acceptance is needed.
- Tolerance is narrower and more specific than appetite.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Capacity, appetite, tolerance