Security GRC · Insight
Risk appetite is a decision, not a document.
If your risk appetite statement has never stopped a project, changed a budget or forced a conversation, it is not doing its job.
In brief
Appetite only works when it is written in business terms, owned by the people who run the business, and tested against real decisions.
Most organisations have a risk appetite statement for security. It is usually approved by the board, reviewed once a year and phrased with care: the organisation has a low appetite for risks that could harm customers, and no appetite for breaches of regulation. Few people disagree with it. Fewer still use it.
The trouble is not the intent. It is that a statement nobody can apply is not a decision. When a product team asks whether it may launch with an open finding, or a supplier asks for an exception to an access rule, "low appetite" gives them nothing to work with. So the question goes to the security team, which has no authority to accept business risk, and the answer depends on who asks and when.
Three tests of a working appetite
- It is written in the business's units. Hours a critical service may be unavailable. Records of a given type that may be exposed. Days a known weakness may stay open. Owners can compare a situation against a number; they cannot compare it against an adjective.
- It names who may decide. Inside tolerance, the service owner decides. Beyond it, the decision rises to a named executive or committee. The security function advises at every level and accepts at none.
- It is tested against decisions. Once a quarter, look at the exceptions granted, the risks accepted and the investments made. If none of them was shaped by the appetite, rewrite it.
Where to start
Pick the three to five services the business could least afford to lose. For each, agree with its owner what tolerable disruption, data exposure and recovery look like. Write those down as tolerances, add who may decide beyond them, and take them to the board as the first page of the appetite. The rest of the statement can follow the same pattern over time.
Done this way, appetite stops being a compliance artefact and becomes the rule that lets the business move quickly, because everyone knows where the line sits and who may cross it.
Questions for your next leadership meeting
- Which security risk has this organisation formally accepted in the past year, and who accepted it?
- Could the owner of our most critical service state its tolerance for disruption in hours?
- When did the risk appetite last change a decision?