What is a risk appetite framework?

• A. The governance structure that defines how risk appetite is established, measured, and enforced.
• B. A list of permissible risks.
• C. A process for internal audits.
• D. A plan for risk avoidance only.

Answer: (A)

A risk appetite framework provides the governance structure that defines how risk appetite is established, measured, and enforced across the organization. It starts with a clear risk appetite statement that links strategy to the amount and types of risk the organization is willing to take. It then sets risk limits and thresholds, identifies key risk indicators, and outlines roles, responsibilities, and processes for monitoring, reporting, and escalation. The framework ensures decisions in planning, budgeting, product design, and operations stay aligned with the stated appetite, and it embeds ongoing review and updating to respond to changes in strategy, markets, or the external environment. This approach turns abstract risk preferences into actionable controls and governance, helping maintain discipline in risk-taking.

A list of permissible risks is not enough because it doesn’t specify how to measure, monitor, or enforce limits or how to embed appetite into decision-making. An internal audits process is a separate function focused on evaluating controls, not a framework for setting and managing risk appetite. A plan for risk avoidance only focuses on avoiding risk and ignores the reality that organizations often accept and manage certain risks within defined limits as part of pursuing objectives.