ISC2 Certified in Cybersecurity (CC)Security PrinciplesMedium
A multinational financial institution is evaluating its overall cybersecurity posture. The board of directors has expressed a desire to accept a higher level of financial risk from cyber-incidents if the potential for higher returns from new digital initiatives is significant. Which concept is the board primarily demonstrating?
- ARisk tolerance
- BRisk treatment
- CRisk appetite
- DRisk likelihood
Show answer & explanationAnswer & explanation
Correct answer: C. Risk appetite
Risk appetite is the amount and type of risk that an organization is willing to pursue or retain in order to achieve its objectives. The board's willingness to accept higher risk for higher returns directly aligns with this definition.
Why the other options are wrong
- A. Risk tolerance refers to the acceptable deviation from the risk appetite, not the overall willingness to take on risk for objectives.
- B. Risk treatment refers to the actions taken to modify risk, such as mitigation or acceptance, not the organizational stance on risk.
- D. Risk likelihood is the probability of a risk event occurring, which is a component of risk, not a strategic decision to accept risk.
Risk Appetite
The amount and type of risk that an organization is willing to pursue or retain in order to achieve its objectives. It's a high-level statement set by senior management and influences strategic decisions.
- Set by senior management/board
- Strategic, high-level decision
- Guides risk management activities
Memory trick: Appetite for risk, Tolerance for its swings.