C1.3 Appetite scale

Orange Book 2023 and Risk Appetite Guidance Note v2.0 [4]

The component requires that appetite be set per risk category on a five-position scale, averse, minimal, cautious, open and eager; that each category carry an optimal position, where the governing body wants to be, and an accepted position, where it will tolerate being for a stated time, with a date by which the optimal is to be regained; that appetite not be lowered to accommodate risks the organization has decided to tolerate; and that any change of position be a governing-body decision with a record (C1.3) [4]. The prohibition names the commonest way appetite statements are corrupted in practice, the drift by which “we exceeded appetite” becomes “we revised appetite,” and forbids it.

It comes from the Treasury's guidance for government, whose current edition is dated May 2023 with an online update in July 2026, and from its appetite note, version 2.0 of 2021, withdrawn from the main page in 2026 and still, as Part II put it, the most concrete method for writing an appetite statement available free anywhere. The note gives appetite a scale, a unit of application, two positions and an eight-step method, and then states the rule against quiet lowering that no other source states. What the component reconciles is the Orange Book's use of tolerance for the position accepted for a time, which collides with every other sense of the word: the framework renames it the accepted position and records the alias. It leaves behind the Orange Book's thirteen categories, a public-sector list; the scale is applied to the first level of the organization's own source-organized taxonomy (C2.1) [3].