Frame
What the objectives are, how much risk is acceptable, and at which level. 7 components, chapter 15 of the book.
Scope, context and criteria
Scope, context and criteria are written and versioned before any assessment. Criteria state how likelihood is judged, how consequence is judged, how they are combined and what is acceptable. Every register row carries the criteria version it was scored under; no score is accepted without one.
Source: ISO 31000:2018 clause 6.3 [1]
Strategy linkage
Three strategy risks are assessed and recorded at least annually: misalignment with mission and values, unweighed implications of the chosen strategy, failure of execution. Risk is viewed across the portfolio by objective, not one row at a time.
Source: COSO ERM principles 6 to 9 and 14 [2]
Appetite scale
Appetite is set per risk category on a five-position scale: averse, minimal, cautious, open, eager. Each category carries an optimal position and an accepted position (the source's “tolerable”), with a date by which the optimal is to be regained. Appetite may not be lowered to accommodate risks already tolerated. Any change of position is a governing-body decision with a record.
Source: Orange Book 2023 and Risk Appetite Guidance Note v2.0 [4]
Layered appetite
Three nested boundaries are stated: the risk universe; the risk universe boundary (the source's “tolerance boundary”), the most the organization could bear; appetite inside it. Appetite is cascaded to strategic, tactical and operational levels, each consistent with the level above and written in that level's terms.
Source: IRM Risk Appetite and Tolerance (2011) [6]
Appetite versus tolerance
Appetite is a broad qualitative statement set by the governing body. Tolerance is a measurable range tied to at least one leading and one lagging indicator. Neither substitutes for the other; an appetite statement with no linked tolerance is recorded as incomplete.
Source: NIST IR 8286 Rev. 1 [9]
Tolerance per objective
Each objective carries its own tolerance, set by the decision authority before alternatives are analyzed. Aggregated risk against an objective is reported as the likelihood of missing it, including an allowance for unidentified risk, not as an average of scores. Consequences are stated against objectives and their tolerances.
Source: NASA Risk Management Handbook v2.0, RIDM [11]
Three tiers
Every risk record declares its tier: organization (enterprise), mission or business process, or system. Roll-up from tier to tier normalizes records as it goes. A record without a tier is rejected.