Risk Appetite
The level and type of risk an organization is willing to accept in pursuit of its objectives. Risk appetite defines the boundary between risks that need treatment and risks that can be consciously accepted.
Why it matters
Without a defined risk appetite, every risk decision is subjective. One manager accepts what another would escalate. Risk appetite gives the organization a shared threshold: risks below it are accepted, risks above it require treatment. This prevents both paralysis from trying to eliminate all risk and recklessness from ignoring risks that exceed what the business can absorb.
In practice
Risk appetite is typically set by leadership and expressed as qualitative statements or quantitative thresholds per risk category. It informs every risk assessment: after evaluating likelihood and impact, you compare the result against your appetite to decide whether treatment is needed. In vucavoid, risk assessments are evaluated against configurable parameters. The VUCA score reflects how well your actual risk exposure aligns with your intended tolerance.