Glossary
Risk appetite
The level of risk management declares it is willing to accept in pursuit of its objectives, expressed so that concrete cases can be decided against it.
- Risk tolerance
Risk appetite is only useful when it is operational. “We have a low risk appetite” decides nothing; “we do not accept internet-exploitable critical vulnerabilities open for more than seven days on systems supporting critical functions” does, because it can be checked against reality and breaches can be measured.
It is also the document that gives formal cover to exceptions. When a finding is accepted as risk, what makes the decision defensible is not the signature of whoever took it, but the fact that it falls inside a threshold management declared beforehand.
In financial services, DORA makes it an explicit obligation: Article 5(2) tasks the management body with setting the ICT risk tolerance level as part of the digital operational resilience strategy. It is not a drafting exercise; it is a parameter that then has to be applied.