Risk Appetite
The amount of risk an entity is prepared to accept when trying to achieve its objectives. When considering the risk appetite levels for the enterprise, two major factors are important:
- The enterprise’s objective capacity to absorb loss, e.g., financial loss, reputation damage
- The (management) culture or predisposition towards risk taking—cautious or aggressive. What is the amount of loss the enterprise wants to accept to pursue a return?
(ISAAC - IT Risk Framework)