Determining if organizational risk is tolerable requires understanding the organization’s risk appetite, which is the amount and type of risk that the organization is willing to accept or pursue in order to achieve its objectives1. Understanding the organization’s risk appetite can help to:
Define and communicate the risk tolerance, which is the acceptable or unacceptable level of risk for each risk category or scenario2.
Guide and align the risk identification, analysis, evaluation, and treatment processes, and ensure that the risks are consistent and proportional to the risk appetite3.
Measure and monitor the risk performance and outcome, and ensure that the residual risk (the risk that remains after the risk responses) is within the risk appetite, or take corrective actions if needed4.
The other options are not the best ways to determine if organizational risk is tolerable, because:
Mapping residual risk with cost of controls is a useful but not sufficient way to determine if organizational risk is tolerable, as it provides a quantitative analysis of the trade-off between the risk level and the risk response cost5. However, mapping residual risk with cost of controls does not consider the qualitative aspects of the risk, such as the impact on the organization’s strategy, culture, or reputation.
Comparing against regulatory requirements is a necessary but not sufficient way to determine if organizational risk is tolerable, as it ensures that the organization complies with the applicable laws, rules, or standards that govern its activities and operations6. However, comparing against regulatory requirements does not guarantee that the organization meets its own objectives and expectations, which may be higher or lower than the regulatory requirements.
Comparing industry risk appetite with the organization’s risk appetite is a helpful but not sufficient way to determine if organizational risk is tolerable, as it provides a reference or a standard for benchmarking the organization’s risk level and performance with its peers or competitors7. However, comparing industry risk appetite with the organization’s risk appetitedoes not ensure that the organization addresses its specific or unique risks, which may differ from the industry risks.
References =
Risk Appetite - CIO Wiki
Risk Tolerance - CIO Wiki
Risk Management Process - CIO Wiki
Risk Monitoring - CIO Wiki
Residual Risk - CIO Wiki
Regulatory Compliance - CIO Wiki
Benchmarking - CIO Wiki
Risk and Information Systems Control documents and learning resources by ISACA
