Risk Appetite

Risk Appetite

Establish risk tolerance levels and acceptance criteria for "$ARGUMENTS". Define how much risk the organization is willing to accept across different categories, and create a structured workflow for risk acceptance decisions.

Prerequisites

None — this is a Phase 0 Govern skill.

Process

1. Define risk categories:

   • Operational risk — system outages, process failures, human error
   • Data breach risk — unauthorized access, exfiltration, exposure of sensitive data
   • Compliance risk — regulatory violations, audit findings, legal penalties
   • Reputational risk — public incidents, customer trust erosion, media exposure
   • Financial risk — direct losses, remediation costs, insurance gaps
   • Third-party risk — vendor breaches, supply chain compromises, dependency failures

2. Set tolerance thresholds per category:

   • For each risk category, define four threshold levels:
     • Critical — unacceptable; immediate action required, escalate to executive leadership
     • High — requires mitigation plan within defined timeframe, senior management approval to accept
     • Medium — managed through standard controls, department-level acceptance
     • Low — accepted as cost of doing business, monitored through routine processes
   • Express thresholds in measurable terms where possible (financial impact ranges, downtime limits, data record counts)

3. Define acceptance criteria and authority levels:

   • Who can accept what level — map risk levels to required approval authority:
     • Critical: board/executive committee only
     • High: CISO or CTO with documented justification
     • Medium: department head or risk owner
     • Low: team lead or security champion
   • Required documentation — what must be recorded for each acceptance (risk description, justification, compensating controls, review date)
   • Time-bound acceptance — maximum duration before re-evaluation (critical: 30 days, high: 90 days, medium: 180 days, low: 365 days)

4. Create risk acceptance workflow:

   • Define the end-to-end process: identification, assessment, escalation, approval, documentation, monitoring
   • Specify required artifacts at each stage (risk register entry, impact analysis, approval record)
   • Define escalation triggers (risk level increase, new threat intelligence, audit findings)
   • Establish override and emergency procedures for time-sensitive decisions

5. Align with business strategy:

   • Map risk appetite to business maturity and growth stage
   • Identify areas where higher risk tolerance enables business objectives (speed to market, innovation)
   • Identify areas where zero tolerance is required (customer data protection, regulatory compliance)
   • Document trade-offs between risk reduction and business agility

6. Write the artifact to .metapowers/security/$ARGUMENTS/00-govern.md with heading:

   Risk Appetite Statement

   Include sections:

   • Risk Categories — all categories with definitions
   • Tolerance Thresholds — threshold matrix per category and level
   • Acceptance Authority — who can accept which risk levels
   • Acceptance Workflow — step-by-step process with required artifacts
   • Strategic Alignment — how risk appetite supports business objectives

Output

The risk appetite statement written to .metapowers/security/$ARGUMENTS/00-govern.md. Present a summary to the user highlighting:

• Risk categories and their tolerance thresholds
• Acceptance authority matrix
• Key trade-offs between risk and business objectives
• Recommended next steps for operationalizing risk appetite