Lion Cipher Lab
Write a risk appetite and tolerance statement
- GRC / Compliance
- Intermediate
- ~55 min
- Free · no account required
Why it matters
A risk register lists what could go wrong; it cannot tell you which items the organization must fix and which it can reasonably live with. That decision belongs to a risk appetite and tolerance statement — a short document, owned at the top of the organization, that says in plain terms how much risk leadership is willing to accept to get its work done, and then draws hard, numeric lines on each kind of risk that must not be crossed without a deliberate, recorded decision. It is one of the highest-leverage artifacts in all of governance, risk, and compliance (GRC) work, because every other…
What you'll learn
- the difference between risk appetite and risk tolerance
- writing a board-ready risk appetite statement
- setting quantitative tolerance thresholds per risk category
- tying key risk indicators (KRIs) to tolerance limits
- defining escalation and breach-response rules
- aligning a statement to NIST CSF 2.0 Govern (GV.RM) and NIST SP 800-39
- how appetite drives which register rows get treated
Steps in this lab
- Appetite vs tolerance: the two words everything here turns on
- Write your scope and who owns the statement
- Write the appetite statement, category by category
- Turn each appetite into a numeric tolerance threshold
- Wire key risk indicators (KRIs) to the thresholds
- Define the escalation rule — what happens when a line is crossed
- Use the statement to re-rank your register, and keep it honest