Which statements demonstrate an effective use of risk appetite in an organization? (Select Two.)

An effective risk appetite framework is dynamic and integral to an organization's strategy. It requires open discussion, including the potential negative impacts of being overly risk-averse, which could stifle innovation and growth. The process of analyzing and debating the risk appetite statements themselves is crucial for ensuring they are well-understood, meaningful, and aligned with the organization's strategic objectives. This iterative analysis helps refine the articulation of risk appetite, making it a practical tool for management rather than a static compliance document.

A. Risk appetite must be reviewed and adjusted for significant changes in business conditions, strategy, or the external environment; it is not static.
C. Specific indicators and metrics (Key Risk Indicators) are essential to monitor adherence to the risk appetite and alert management when thresholds are breached.
D. Risk appetite is the aggregate level of risk an organization will accept, while risk tolerance sets specific deviation limits around that appetite. They are related but distinct concepts.

1. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2017). Enterprise Risk Management—Integrating with Strategy and Performance. Section: "Risk Appetite," pp. 47-56.

2. Financial Stability Board. (2013). Thematic Review on Risk Governance. Peer Review Report. Section 3.2: "Defining and articulating risk appetite and risk tolerance," p. 11.

3. ACAMS. (2023). Advanced CAMS-Audit Certification Study Guide. Chapter 2: "AML/CFT Risk Assessments," Section on Risk Appetite and Tolerance.