Risk Capacity
What is Risk Capacity?
The maximum amount of risk an organization can absorb before it threatens its continued viability and ability to achieve core objectives.
Frameworks that govern risk capacity
What the standards actually require on risk capacity
Requirements naming risk capacity across 3 standards, quoted from the control text.
The governing body keeps examining and evaluating how risk bears on the use of I&T now and in future, considers whether the enterprise's appetite for risk is suitable, and sees that risk to enterprise value arising from I&T is identified and managed.
cobit-2019::EDM03.01 · EDM03.01 Evaluate risk management →Risk appetite is defined with reference to how the entity creates, preserves and realizes value. There is no universal or right appetite;
coso-enterprise-risk-management-erm-framework-2017::P7 · Principle 7: Defines Risk Appetite →The insurer must have a risk appetite statement that articulates the aggregate level and types of risk it will assume within its risk capacity to achieve its financial and strategic objectives and business plan, takes into account all relevant and material ris...
iais-insurance-core-principles-icps::16.4 · 16.4 A risk appetite statement covering aggregate risk, all material risk categories and operationalised through risk limits →Questions people ask about risk capacity
What is Risk Capacity?
Why is Risk Capacity important for compliance?
Which compliance frameworks address Risk Capacity?
Where can I learn more about Risk Capacity?
See how Risk Capacity applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.