C1.4 Layered appetite

IRM Risk Appetite and Tolerance (2011) [6]

The component requires three nested boundaries, stated and distinguished: the risk universe, meaning everything the organization is exposed to; the risk universe boundary, meaning the most it could bear without failing its obligations, which is the source's tolerance boundary under the name chapter 11 gave it; and appetite inside that boundary. It requires that appetite be cascaded and expressed at three levels, strategic, tactical and operational, each level's statement consistent with the one above and written in the terms the people at that level use (C1.4) [6]. A position on a five-point scale means something to a governing body and nothing to a desk, and the component requires the translation to be done and written down.

It comes from the practitioner body's 2011 paper on appetite and tolerance, which Part II found to be the source that makes appetite a nested structure rather than a number and sets it at three organizational levels, with six principles and twenty-five questions a board can ask. The component carries the questions into the first step of the operating cycle, communicate and consult. What it reconciles is the reversal that chapter 11 called the clearest case in the book of a near-synonym that is in fact an antonym: the practitioner body's tolerance is the outer ring, the Orange Book's an inner position. The framework keeps the practitioner body's structure, renames its middle ring the risk universe boundary and reserves tolerance for C1.5 and C1.6. The diagram can be drawn unchanged with the labels replaced.