02 — Capability · BC-130.10
Risk Framework & Appetite
Define what the enterprise means by risk, how it is categorized and scored, and how much of each kind the board is prepared to accept, so every assessment uses the same yardstick.
- Risk Governance
- Risk Appetite Statement
- Risk Taxonomy
In scope
- Risk policy and governance structure
- Risk taxonomy and scoring scales
- Risk appetite and tolerance statements
Out of scope
- Board committee operations (see BC-120)
Decomposes into · 3
- BC-130.10.10Risk Policy & GovernanceSet the roles, committees and escalation routes through which risk is owned at the first line, overseen at the second and assured at the third.
- BC-130.10.20Risk TaxonomyMaintain the shared categories and definitions that let risks from different parts of the enterprise be compared and aggregated.
- BC-130.10.30Risk Appetite DefinitionExpress how much risk of each type the enterprise will accept in pursuit of its objectives, with tolerances that trigger action when crossed.