CRISC - Governance - Section 1.9

Define risk appetite and risk tolerance and use them to guide risk decisions.

Distinguish risk appetite, risk tolerance, and risk capacity, and explain how each concept sets a different boundary on acceptable risk-taking. Use defined thresholds to evaluate whether a proposed action is within tolerance or requires escalation to a governance body.

Risk appetiteRisk toleranceRisk capacityThresholds

Practice question for this objective

Free sampleGovernancehard

A lender tightens covenants and the organisation's available capital buffer falls sharply, although the board has not changed its stated willingness to accept information risk. The risk practitioner is asked what this change means for the existing risk appetite. What should the practitioner advise?

  • ARe-examine the appetite against the reduced capacity, because appetite must sit within capacity and a lower buffer may have pushed the stated position above that ceiling Correct
  • BLeave the appetite unchanged, because appetite reflects the board's chosen willingness and is independent of the financial position at any point in time
  • CLower the operational tolerance thresholds alone, because adjusting the day-to-day limits keeps the enterprise appetite statement stable and avoids board involvement
  • DRaise the appetite to signal continued ambition, because a constrained balance sheet makes pursuing higher-return, higher-risk activity more necessary than before
Recognise that a fall in risk capacity can force a review of risk appetite because appetite must remain within capacity. Risk capacity is the objective maximum loss the organisation can absorb before viability fails, and appetite is a chosen position that must sit at or below it; when capacity drops, a previously valid appetite may now exceed the survival ceiling and must be re-examined.

Why A is correct: Capacity is the survival limit appetite must respect, so a material fall in capacity is precisely the event that requires the board to reconsider whether its appetite still fits.

Why B is wrong: Treating appetite as fixed feels principled, but appetite must remain at or below capacity, so a fall in capacity can leave the stated appetite untenable.

Why C is wrong: Tightening thresholds is a tempting quick fix, yet it treats a symptom; the underlying appetite may now exceed a reduced capacity and that must be revisited at board level.

Why D is wrong: Pushing appetite up to chase returns is superficially commercial, but it widens the very gap to a shrunken capacity ceiling and increases the chance of a fatal loss.

See more CRISC practice questions, answers explained.

More in this domain

Back to all Governance objectives, or the CRISC cert hub.

Examworthy is not affiliated with or endorsed by ISACA. Original, blueprint-aligned practice material only.