Reader small image

You're reading from  Certified Information Security Manager Exam Prep Guide - Second Edition

Product typeBook
Published inDec 2022
PublisherPackt
ISBN-139781804610633
Edition2nd Edition
Right arrow
Author (1)
Hemang Doshi
Hemang Doshi
author image
Hemang Doshi

Hemang Doshi has more than 15 years of experience in the field of system audit, IT risk and compliance, internal audit, risk management, information security audit, third-party risk management, and operational risk management. He has authored several books for certification such as CISA, CRISC, CISM, DISA, and enterprise risk management.
Read more about Hemang Doshi

Right arrow

Differentiating Risk Capacity, Risk Appetite, and Risk Tolerance

The first step toward understanding risk management is to learn the following three important terms:

  • Risk capacity: This is the maximum risk an organization can afford to take.
  • Risk tolerance: Risk tolerance levels are acceptable deviations from the risk appetite.
  • Risk appetite: This is the amount of risk that an organization is willing to take.

The following example further explains these terms.

Mr. A's total savings are $1,000. He wants to invest in equities to earn some income. Since he is risk averse, he decides to invest only up to $700. If the markets are good, he is willing to invest a further $50. In terms of risk capacity, risk appetite, and risk tolerance, the following can be derived:

  • Risk capacity: Total amount available, i.e., $1,000
  • Risk appetite: Mr. A's willingness to take a risk i.e., $700
  • Risk tolerance: Acceptable deviation from the risk appetite...
lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Certified Information Security Manager Exam Prep Guide - Second Edition
Published in: Dec 2022Publisher: PacktISBN-13: 9781804610633

Author (1)

author image
Hemang Doshi

Hemang Doshi has more than 15 years of experience in the field of system audit, IT risk and compliance, internal audit, risk management, information security audit, third-party risk management, and operational risk management. He has authored several books for certification such as CISA, CRISC, CISM, DISA, and enterprise risk management.
Read more about Hemang Doshi