Of the following, who is PRIMARILY responsible for determining an organization's risk appetite and risk tolerance?

The correct answer is D. Senior management. Risk appetite (how much risk the organization is willing to accept) and risk tolerance (acceptable variance around that appetite) are strategic business decisions that must be set by senior management - typically the board of directors or C-suite. These decisions reflect the…

Submitted by renata2k· Apr 18, 2026Information Security Governance

Question

Of the following, who is PRIMARILY responsible for determining an organization’s risk appetite and risk tolerance?

Options

AInformation security manager
BChief risk officer (CRO)
CProcess owners
DSenior management

How the community answered

(34 responses)

B
3% (1)
C
3% (1)
D
94% (32)

Explanation

Risk appetite (how much risk the organization is willing to accept) and risk tolerance (acceptable variance around that appetite) are strategic business decisions that must be set by senior management - typically the board of directors or C-suite. These decisions reflect the organization's strategic objectives, stakeholder expectations, and accountability to shareholders. The CRO (Option B) advises on and operationalizes risk management but works within bounds set by senior management. The information security manager (Option A) implements controls within those bounds. Process owners (Option C) manage risk within their specific domains but do not set organizational-level thresholds.

Topics

#risk appetite#risk tolerance#governance#roles and responsibilities

Community Discussion

No community discussion yet for this question.

Full CISM Practice