<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-risk-appetite-statements
description: >-
  Develop organizational risk appetite and tolerance statements that define acceptable risk levels across categories, enabling consistent risk-based decision-making aligned to business objectives.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - risk-appetite
  - risk-tolerance
  - risk-capacity
  - risk-governance
  - decision-framework
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Risk Appetite Statements

## Overview

Risk appetite statements formalize how much risk an organization is willing to accept in pursuit of its objectives. This technique covers building appetite frameworks across risk categories (cyber, operational, compliance, strategic) with measurable tolerance thresholds that guide day-to-day decisions.

Mode: `[MODE: ARCHITECT]` — Risk appetite framework design and governance.

## Prerequisites

| Requirement | Details |
|---|---|
| Board risk governance charter | Defines risk oversight structure |
| Risk categories | Aligned to organizational structure |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Risk Appetite Hierarchy

```
Risk appetite framework:
├── Risk Capacity (maximum risk the org can absorb)
│   ├── Financial reserves and insurance coverage
│   ├── Operational resilience capabilities
│   └── Regulatory buffer (distance from non-compliance)
├── Risk Appetite (amount of risk willing to pursue)
│   ├── Board-approved statements per risk category
│   ├── Qualitative: "We have LOW appetite for..."
│   └── Quantitative: "Maximum acceptable ALE: $5M"
├── Risk Tolerance (acceptable deviation from appetite)
│   ├── Specific thresholds triggering escalation
│   ├── KRI trigger values
│   └── Time-based limits (temporary exceedances)
└── Risk Limits (hard boundaries — never exceed)
    ├── Regulatory requirements (non-negotiable)
    ├── Data breach notification thresholds
    └── Business continuity minimum requirements
```

### 2. Appetite Statements by Category

```
Cybersecurity Risk Appetite:
├── "The organization has LOW appetite for risks that
│    could result in unauthorized access to customer data"
├── Tolerance: Maximum 2 high-severity vulnerabilities
│   in production at any time
├── Limit: Zero tolerance for unencrypted PII at rest
└── KRI trigger: >5 critical findings → immediate escalation

Compliance Risk Appetite:
├── "The organization has VERY LOW appetite for
│    regulatory non-compliance"
├── Tolerance: All audit findings remediated within 90 days
├── Limit: Zero material compliance violations
└── KRI trigger: Any regulatory inquiry → board notification

Operational Risk Appetite:
├── "The organization has MODERATE appetite for
│    operational disruption in non-critical systems"
├── Tolerance: 99.9% uptime for Tier 1 services
├── Limit: Maximum 4-hour RTO for critical systems
└── KRI trigger: >2 P1 incidents/quarter → review
```

### 3. Decision Framework

```
Risk acceptance decision tree:
├── Is risk within appetite? → Accept (risk owner approval)
├── Is risk within tolerance? → Accept with monitoring (CISO approval)
├── Is risk above tolerance? → Escalate to risk committee
├── Is risk at or near limit? → Escalate to board
└── Does risk exceed limit? → Immediate remediation required
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
