Risk Appetite and Tolerance

Try it out loud first. Then check yourself:

1. Appetite: the amount and type of risk the board is willing to pursue for objectives. Set by the board, not security.
2. Tolerance: measurable acceptable deviation, e.g. no critical internet-facing vuln open more than 7 days.
3. Operationalize with KRIs and thresholds (green/amber/red) that trigger escalation when breached.
4. Risk acceptance must be time-bound, owned by a business exec, and re-reviewed; exceptions register tracks them.
5. Qualitative statements (low appetite for data loss) should translate into quantitative loss bounds where possible.

If the interviewer pushes back

• A product VP wants to launch with a known high-risk finding. Walk through how appetite and tolerance decide this.
• How do you avoid KRIs that are easy to measure but do not predict loss?