Governance · Topic 6 of 7
Risk Profile, Risk Appetite and Risk Tolerance
CRISC risk profile, risk capacity, appetite and tolerance: who sets them, how to express thresholds, and what to do when risk exceeds the agreed limits.
- 5 min
- Includes a diagram
- Capacity is the limit; appetite is the choice; tolerance is the acceptable deviation.
- The board sets appetite; the practitioner assists and advises.
- Appetite is made operational through tolerances and KRI thresholds.
What it is
The risk profile is the overall picture of the risks an organization currently faces: what they are, how large they are and how they are trending. Risk appetite is the amount and type of risk the organization is willing to accept in pursuit of its objectives. Risk tolerance is the acceptable deviation from that appetite or from a specific objective.
Comparing the profile with appetite and tolerance is how management decides whether to act. The job practice asks the practitioner to help stakeholders select appetite and tolerance thresholds, not to set them.
How it works
Capacity, appetite and tolerance
| Term | Meaning | Set by |
|---|---|---|
| Risk capacity | The maximum risk the organization can absorb before it fails or breaches critical obligations | Fact of the organization's finances and obligations |
| Risk appetite | Broad level and types of risk the organization wants to take to meet objectives | Board, with senior management |
| Risk tolerance | Acceptable variation around appetite or an objective, often per risk or metric | Senior management, within appetite |
Appetite must sit below capacity. Tolerances make appetite usable day to day by turning it into specific thresholds.
Expressing appetite
Appetite statements can be qualitative ("We have no appetite for breaches of customer privacy law") or quantitative ("We accept no more than 4 hours of unplanned downtime per year for payment services"). Good statements cover each major risk category, are approved by the board, and are translated into measurable tolerances and key risk indicator (KRI) thresholds.
| Category | Example appetite | Example tolerance |
|---|---|---|
| Availability | Low appetite for customer-facing outages | Payment service availability no lower than 99.9% per month |
| Data protection | Very low appetite for loss of personal data | Zero unencrypted laptops holding customer data |
| Innovation | Moderate appetite for new technology pilots | Pilots limited to non-production data |
Appetite can differ by category. An organization may be cautious on compliance and bolder on innovation.
The risk profile
The risk profile aggregates risks from the risk register across the organization. It shows the main risks, their current ratings, owners, trends and how they compare to appetite. It changes as the business, threats and controls change, so it must be refreshed regularly and after major events.
A current state profile shows today's risk; a desired state shows where management wants it to be. The gap between them drives treatment plans and investment.
When risk exceeds appetite
The practitioner determines whether risk exceeds appetite and tolerance, then recommends treatment options to the risk owner. Risk within appetite may be accepted. Risk above tolerance must be escalated to the level of management with authority to decide, according to the escalation rules in the risk policy.
Reviewing appetite
Appetite is reviewed at least annually and whenever strategy, regulation, the market or the organization's financial position changes significantly. Appetite that has not changed after a merger or a major new regulation is a warning sign.
A worked example
An online retailer's board states a low appetite for outages of the checkout service. Management sets a tolerance of no more than 2 hours of unplanned checkout downtime per quarter. A KRI tracks cumulative downtime with amber at 1 hour and red at 2 hours.
Midway through the quarter, downtime reaches 1 hour 40 minutes. The practitioner reports the amber status and trend to the checkout risk owner, analyses the causes and recommends options, such as adding capacity before the holiday peak. The risk owner decides, and the decision is recorded.
How the exam asks about this
- "Who is responsible for setting the organization's risk appetite?" The board of directors, with senior management.
- "What should the risk practitioner do when a risk exceeds tolerance?" Report and escalate it to the risk owner and appropriate management with treatment options.
- "Which is the BEST way to make risk appetite usable in operations?" Translate it into measurable tolerances and KRI thresholds.
What to remember for the exam
- Capacity is the limit; appetite is the choice; tolerance is the acceptable deviation.
- The board sets appetite; the practitioner assists and advises.
- Appetite is made operational through tolerances and KRI thresholds.
- The risk profile aggregates the register and is compared to appetite.
- Risk above tolerance is escalated according to policy, with options for the owner.
A risk practitioner who finds risk above appetite does not accept or fix it alone. The correct action is to report and escalate it to the person with authority, with recommended treatment options.
Common mistakes
Confusing appetite and tolerance. Appetite is the broad amount of risk wanted; tolerance is the measurable variation allowed around it.
Setting appetite above capacity. That would allow the organization to take risks it could not survive.
Never revisiting appetite. Strategy, regulation and finances change, so appetite must be reviewed on a schedule and on major change.
Check yourself
What is the difference between risk capacity and risk appetite?
Capacity is the maximum risk the organization could absorb; appetite is the lower level it chooses to accept to meet its objectives.
How is risk appetite turned into something operational teams can use?
By setting measurable tolerances for each area and linking them to KRI thresholds that trigger action.
What is the risk profile compared against to decide on action?
Risk appetite and tolerance; risks that exceed them need treatment or escalation.
Topic 6 of 7 in Governance
Test yourself on Governance
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.