Differentiate risk appetite from risk capacity?

Differentiate risk appetite from risk capacity?

• A. Appetite is the maximum risk; capacity is the minimum risk desired.
• B. A temporary tolerance for risk during crisis; prevented by outsourcing risk.
• C. Appetite is the amount of risk the organization is willing to take; capacity is the maximum risk it can bear given resources.
• D. Appetite relates to financial risk only; capacity relates to operational risk only.

Answer: (C)

The key idea is distinguishing willingness to take risk from the ability to absorb risk. Risk appetite is the amount of risk the organization is prepared to take in pursuit of its objectives, reflecting strategy, values, and risk culture. It sets the levels of risk that are acceptable in decision-making and opportunity selection. Risk capacity is the maximum level of risk the organization can bear given its resources, controls, capital, and buffers—the ceiling it cannot reasonably exceed without endangering viability. So the best description is that appetite is the amount of risk the organization is willing to take, while capacity is the maximum risk it can bear given resources. For example, a company might have a high appetite for growth opportunities, but its capacity could be constrained by limited capital or weak risk controls, limiting how much risk it can actually take on. The other statements mix up these ideas: appetite is not the maximum risk, and capacity is not a minimum risk, so that pairing is incorrect. A crisis-time “temporary tolerance” or outsourcing does not define appetite or capacity. And risk appetite and capacity apply across all risk types, not just financial or operational risk.

The key idea is distinguishing willingness to take risk from the ability to absorb risk. Risk appetite is the amount of risk the organization is prepared to take in pursuit of its objectives, reflecting strategy, values, and risk culture. It sets the levels of risk that are acceptable in decision-making and opportunity selection. Risk capacity is the maximum level of risk the organization can bear given its resources, controls, capital, and buffers—the ceiling it cannot reasonably exceed without endangering viability.

So the best description is that appetite is the amount of risk the organization is willing to take, while capacity is the maximum risk it can bear given resources. For example, a company might have a high appetite for growth opportunities, but its capacity could be constrained by limited capital or weak risk controls, limiting how much risk it can actually take on.

The other statements mix up these ideas: appetite is not the maximum risk, and capacity is not a minimum risk, so that pairing is incorrect. A crisis-time “temporary tolerance” or outsourcing does not define appetite or capacity. And risk appetite and capacity apply across all risk types, not just financial or operational risk.