Why this module exists. Risk appetite is where governance meets engineering reality. Without a stated appetite, every risk decision becomes ad hoc — defended by whoever speaks loudest in the room. With a clear appetite stated in measurable terms, the same decision becomes mechanical: “this exceeds the stated threshold, escalation triggered.” This module walks the practitioner-level structure of a usable RAS.
The four-quadrant model — appetite, tolerance, capacity, trigger
The terms get used interchangeably and they mean different things:
- Risk appetite: what the organisation wants the exposure to be. Forward-looking, strategic.
- Risk tolerance: what the organisation will accept as deviation from appetite. The corridor around the appetite line.
- Risk capacity: the maximum exposure the organisation can absorb without existential damage. The hard ceiling.
- Escalation trigger: the specific threshold at which control of the decision moves up the hierarchy.
A useful RAS states all four for each risk category. Most published RAS documents conflate them, which is why they fail to drive decisions.
Get a DPDP gap assessment
Free 30-minute call. We map your data flows against DPDP §8 obligations and tell you exactly which gaps to fix first. Auditor-defensible output.