Risk appetite is the level of risk an organization is willing to accept in order to achieve its objectives. It is defined by top management and determines the point at which the risk assessment requires action.
When the appetite is not defined, the risk matrix becomes dysfunctional: which score is acceptable and which requires action varies from person to person, and prioritization becomes impossible.
The appetite does not have to be a single level across the organization. It is common practice to define a very low appetite in areas such as occupational health and safety or product safety, and a higher one for commercial and investment decisions.
Related terms: Residual Risk · Risk-Based Thinking · Risk Matrix
Related training: Risk-Based Thinking and Risk Management