Study. uk . com
  1. Home
  2. All questions
  3. Question 277

CISM study material · question 277 of 1000

A programme drafts detailed operational risk tolerance statements before any appetite has been agreed. Which sequencing does IR 8286 describe?

  1. Appetite applies only where tolerance cannot be quantified
  2. Appetite is defined first so that meaningful tolerance statements can be created beneath it
  3. Tolerance is defined first and appetite derived from it
  4. The two are defined independently and reconciled afterwards
Show the answer

Answer: B. Appetite is defined first so that meaningful tolerance statements can be created beneath it

IR 8286 puts appetite first and communicated, because tolerance statements are only meaningful — usable and monitorable — once there is an appetite for them to sit beneath.

Source: NIST IR 8286 (NIST) — Sec. 3.1.2 Risk Management Strategy

Challenge yourself on this topic → Study as cards