Which statement correctly distinguishes risk appetite from risk capacity?

• A. Appetite is the maximum risk the organization can absorb; capacity is the level of risk pursued.
• B. Appetite is the level of risk that the organization is willing to pursue; capacity is the minimum capital reserved to cover losses.
• C. Appetite is the type of risk pursued, while capacity is the maximum amount the organization can absorb.
• D. Appetite determines regulatory requirements; capacity determines governance structure.

Answer: (C)

Risk appetite guides what kinds of risk and how much risk the organization is willing to pursue in line with its objectives. It sets the boundaries for decision-making—the types of risk that are acceptable (credit, market, operational, etc.) and the level at which the organization is prepared to pursue them.

Risk capacity, on the other hand, is about the organization’s ability to absorb losses given its resources—primarily capital and liquidity. It represents the maximum amount of risk the entity can sustain without jeopardizing solvency or financial stability.

So the correct statement aligns with this distinction: appetite refers to the type and level of risk the organization is willing to pursue, while capacity sets the ceiling on how much risk it can absorb. This separation ensures that the level of ambition in risk-taking does not exceed the organization’s ability to withstand potential losses.

The other options mix up these ideas. Appetite is not the maximum risk absorbed; capacity is not the minimum capital to cover losses, and appetite and capacity do not directly determine regulatory requirements or governance structure in the simplistic way those choices imply.