A board sets a risk appetite of "no more than $2 million of annual credit losses," then approves a lending push that models to $3.4 million of expected losses. Nothing broke. The organization simply took risk it said it would not take, and nobody noticed because appetite lived in a document instead of a decision.
Risk is the possibility that an event occurs and affects the achievement of objectives. It is not automatically bad. Upside variance is risk too, which is why the exam prefers "effect on objectives" over "chance of loss."
Risk management is the process management uses to identify, assess, respond to, and monitor risks so that objectives are achieved within the level of risk the board accepted. That is risk management defined, and risk appetite and risk tolerance are how the accepted level gets stated. Three features matter:
- Owned by management: Management runs the process. Internal audit provides assurance over it and may advise, but does not own risk decisions.
- Objective-anchored: Every risk is a risk to something. No objective, no risk.
Common mistakes
- Treating appetite and tolerance as synonyms. Appetite is board-level and broad ("moderate credit risk"); tolerance is metric-level and numeric ("close within 5 days, never past 7").
- Using capacity as appetite. $40 million of absorbing capital does not make appetite $40 million.
- Calling a shared risk eliminated. Insurance moved $500,000 of the $625,000; the accountability, the regulatory duty, and the reputation exposure never moved.
Bottom line
- Risk is the effect of uncertain events on objectives, including upside; risk management is management's process to identify, assess, respond to, and monitor those effects.
- Appetite: board-set, broad, enterprise-level willingness to accept risk. Tolerance: management-set, narrow, numeric variation allowed around one objective.
- Capacity is the maximum survivable risk and sits above appetite; the two are never equal by definition.
- Cycle order: objectives and appetite, identify, assess and prioritize, respond, monitor and report, then loop back.
Exam shortcut
Compute residual first, then compare it to the stated ceiling. Almost every numeric stem hands you inherent likelihood × impact, a control effect, and an appetite number; the answer is whichever response closes the gap at the lowest cost.
The full lesson (about 2,282 words, 15 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 5
Browse all free CIA Part 1 lessons or jump into free CIA Part 1 practice questions.