Risk Appetite
Definition
The amount and type of risk that an organization is prepared to seek, accept, or tolerate in pursuit of its long-term objectives. Risk appetite is a strategic, board-level statement that sets the overall tone for risk-taking across the organization. It is broader and more directional than risk tolerance, which provides specific measurable thresholds.
Context
Risk appetite statements inform the calibration of risk matrices, the setting of risk tolerance thresholds, and the governance framework for risk acceptance decisions. A facility with a conservative risk appetite will have tighter tolerance thresholds and more rigorous approval requirements for risk acceptance.
Examples
- An organization's risk appetite statement reads: 'We will not accept any foreseeable risk of personnel fatality or major environmental harm. We accept moderate operational risk where the cost of further reduction is grossly disproportionate to the benefit.'
- A risk appetite review leads to lowering the acceptable RPN threshold from 200 to 150 after an industry peer experiences a major incident.
Applicable Standards
- ISO 31000:2018
- COSO ERM
- IRM Risk Appetite Guidance
Related Terms
The degree of risk that an organization is willing to withstand in pursuit of its objectives, expressed as specific thresholds or boundaries for different risk categories. Risk tolerance defines the upper boundary of acceptable risk — risks exceeding tolerance levels must be treated, transferred, or avoided. Risk tolerance is more specific than risk appetite and is typically expressed as quantitative criteria.
Risk AcceptanceA formal, documented decision to accept a specific risk without further treatment, based on a determination that the risk level is within the organization's risk tolerance criteria or that further risk reduction is not reasonably practicable (ALARP). Risk acceptance requires explicit authorization from a designated decision-maker, documented rationale, a defined review period, and specified conditions or limitations.
ALARP(ALARP)As Low As Reasonably Practicable — a principle requiring that residual risk be reduced to the lowest level that is reasonably achievable, balancing the cost and effort of further reduction against the benefit gained. The burden of proof lies on the duty holder to demonstrate that further risk reduction is grossly disproportionate to the benefit.
ISO 31000Risk Management standard — provides principles, a framework, and a process for managing risk. It applies to any type of risk regardless of its nature, whether having positive or negative consequences, and can be applied throughout the life of an organization to many activities including governance, operations, and decision-making at all levels.
Where this appears in Reliatic
This concept is used in the FMEA & Risk module.