Skip to main content

Risk Appetite and Risk Tolerance

According to Higgins (2010) “Risk appetite is the amount of risk an organization is willing to take on or is prepared to accept in pursuing its strategic objectives”, (p.16). This willingness is influenced factors such as financial resources, objectives, risk capacity, existing risk profile, risk tolerance and risk attitude (Wendell, 2012) and (COSO, 2012). Conducting it is important as it provides a vital piece of information; it can provide bounds (upper and lower) on the strategies and decisions that are utilized to pursue the organization's objectives.

According to COSO (2012), risk tolerance is
The acceptable level of variation relative to achievement of a specific objective, and often is best measured in the same units as those used to measure the related objective. In setting risk tolerance, management considers the relative importance of the related objective and aligns risk tolerances with risk appetite. Operating within risk tolerances helps ensure that the entity remains within its risk appetite and, in turn, that the entity will achieve its objectives (p.11)

From both definitions, it can be seen that risk appetite is broad and should be set at the senior management level and then communicated throughout the organization (Higgins, 2010) whereas risk tolerance is operational (COSO, 2012).

If an organizations risk appetite-related to financial strength is 30% annual profit margin, then having a risk tolerance of 20% profit margin for a specific sector in the organization is possible. It is possible if the other sectors (non-governmental) are actually yielding more profit to offset the lower percentage profit margin in the governmental sector. However, since the risk appetite is set on a broader scale, then deviations should be avoided.

References

COSO. (2012). Enterprise risk management: Understanding and communicating risk appetite.
Hopkin, P. (2014). Fundamentals of risk management: understanding, evaluating and implementing effective risk management, 3rd ed. The Institute of Risk Management, 2014. ISBN: 9780749472443.
Wendell, P. J. (2012). COSO publishes new thought paper on enterprise risk management. SEC Accounting Report, 38(4), 4-5. Retrieved from https://search-proquest-com.ufairfax.idm.oclc.org/docview/1459697354?accountid=158316
Higgins, R. (2010). What feeds an organization's risk appetite? Rough Notes, 153(8), 16-17. Retrieved from https://search-proquest-com.ufairfax.idm.oclc.org/docview/746905543?accountid=158316
Labels:

Comments

Post a Comment

Popular posts from this blog

Summary: NIST SP 800-64 Rev 2

Although there may be numerous methodologies available today for developing software whether it is based on a sequential, prototyping or even iterative model, the absence of security at each phase will render applications being vulnerable and easily exploitable when deployed. NIST 800-64 Rev. 2 provides a guide that incorporates security into a sequential model of a SDLC. Currently, at my organization this type of model is preferred since there are small development teams. One of the first recommendations made by is NIST 800-64 Rev. 2 is based on policy and guidelines. It states that there should be a written SDLC policy tailored to suit whether the business develops its own software or outsources software development and even maintenance. At my organization, there is a mesh of both. Large complex enterprise systems are usually outsourced while smaller manageable applications are developed in-house where there may not be an alternative available at a low cost. For example, human re...
1 comment
Read more

Summary: NIST SP 800-61 Rev 2

On another note, with respect to incident response management, the purpose is to provide a plan for a clear path of resolving a security breach. According to the Special Publication NIST 800-61 Rev. 2, the first thing that an organization should do is establish a clear organizational meaning of the word “incident”. It provides a guide to incident handling and recommends establishing response capabilities, incident response policies, an IR plan, procedures, information sharing mechanisms, team structure and even collaboration with external groups. The team’s structure, the services they provide along with the policies and procedures are established. This team consists of: internet service providers, incident reporters, law enforcement agencies, software and support vendors, customers and media as well as other teams. The recommended incident handling procedure consists of: preparation, detection and analysis, containment, eradication and recovery. During the preparation phase, the s...
1 comment
Read more

Software Defined Networks: An Introduction

Description of the technology (Urias, Stout, & Loverro, 2015) Software defined networks (SDNs) is an emerging technology that is changing the defense and networking paradigm. (Hande, Jadhav, Patil, & Zagade, n.d.) Traditionally, network devices like switches and routers, using protocols (on the control plane) such as Open Shortest Path First(OSPF), Border Gateway Protocol(BGP) and Spanning Tree Protocol(STP) determine the best port or interface to forward packets (on the data plane). These routing protocols use static information such as hop count to determine the best path through the network. Moreover, (Ali, Sivaraman, Radford, & Jha, 2015) this decentralized method of network management is the leading cause of network faults and bugs due to errors during configuration. Not to mention, a proliferation of ’internet ossification phenomenon’ which is basically the stagnated network innovation. Additionally, there was no segregation of control and data plane which is har...
Post a Comment
Read more