A documented, often high level, definition of the organization’s risk appetite, typically approved by an organization’s governing board or committee. Risk appetite statements are typically expressed with high level qualitative or quantitative metrics. Risk appetite frameworks, based upon and consistent with risk appetite statements, identify more detailed metrics usable in day-to-day operations.
