Risk appetite: what it is and how a tech supplier sets one

The customer's due diligence questionnaire has a governance section, and one question stops the team: "How does your board set and oversee risk appetite?" At the same time, your ISO 27001 consultant or auditor is asking for risk acceptance criteria, and nobody has written down which risks the business will live with.

Risk appetite is the amount and type of risk a firm is willing to take to meet its objectives, set by its leadership. For a B2B tech supplier, risk appetite is a short, board-approved statement with measurable tolerances. Your ISO 27001 risk acceptance criteria, your SOC 2 risk assessment and your answers to customer due diligence all depend on it.

This guide is for founders, CTOs and security leads at UK SaaS and technology firms with 25 to 150 staff, selling into financial services, insurance or the public sector. It covers the terms, where appetite shows up in your programme, a six-step method for writing the statement, illustrative examples and the mistakes to avoid.

What is risk appetite?

Risk appetite is a leadership decision about how much risk, and which kinds, the business will accept while pursuing its goals. It is written as a short statement per risk category, with measurable limits. A clear appetite does not remove risk: it shows where the line sits, so decisions below the line move quickly and decisions above it escalate.

The NCSC's board toolkit puts the purpose plainly. Setting a risk appetite for cyber helps define the level of risk an organisation will manage while pursuing its objectives, which aids decision making. The NCSC also advises boards to "be specific when defining what is and isn't accepted".

Risk appetite sits inside a wider risk management process. For the vocabulary and the overall cycle of identifying, analysing and treating risk, see our ISO 31000 overview.

What is the difference between risk appetite, risk tolerance and risk capacity?

Risk appetite is the level of risk you choose to take. Risk tolerance is the measurable limit around that choice, the point at which a risk must be escalated or treated. Risk capacity is the most risk the business could absorb before it fails, financially, operationally or contractually. Appetite should always sit well inside capacity.

The words get mixed up in practice, and that matters less than the structure: each category needs a statement in words and a number someone can check.

One caution on terms. Searches for "risk tolerance" in the UK return a lot of investor-questionnaire material, which is a different idea. Your regulated customers also use "impact tolerance". That is their own operational resilience measure for important business services, not a limit you set.

Why does a B2B tech supplier need a risk appetite statement?

A B2B tech supplier needs a risk appetite statement because four things it already does depend on one. ISO 27001 asks for risk acceptance criteria. SOC 2 asks for a risk assessment against clear objectives. Customer questionnaires ask how the board oversees risk. Regulated customers push their appetite down through contract terms. One statement answers all four consistently.

ISO 27001 risk acceptance criteria

ISO/IEC 27001:2022 clause 6.1.2 requires you to define and apply an information security risk assessment process, including criteria for accepting risks and for performing assessments. Clause 6.1.3 then asks risk owners to approve the treatment plan and accept the residual risk.

Risk acceptance criteria are risk appetite turned into a scoring rule. Our guide to ISO 27001 clause 6.1 calls the acceptance line the most load-bearing sentence in the methodology. Write the appetite first, and the acceptance line has something to stand on. The clause 8.2 guide covers running the assessment against those criteria.

The SOC 2 risk assessment (CC3)

The common criteria in the AICPA's 2017 Trust Services Criteria include a risk assessment group, CC3. It covers setting objectives clearly enough to identify risks, then identifying and analysing those risks, including fraud and change. One of the AICPA's points of focus for CC3.1 is that management considers its tolerances for risk. An auditor will want to see how you decide which risks need a response.

A risk appetite statement is the cleanest way to show that decision rule. Our guide to the Trust Services Criteria explains the CC3 group alongside the other common criteria. The SOC 2 overview covers the report itself.

Customer due diligence on board oversight

Enterprise and regulated buyers ask governance questions as well as control questions. Typical wording asks who owns risk at board level, how often the board reviews it and what it has decided. A written appetite statement with an approval date and a review record answers those questions with evidence rather than reassurance.

A questionnaire answer of "the board takes risk seriously" tells the buyer nothing.

An answer of "the board approved our risk appetite statement in March and reviews it each year; here are the five categories and their tolerances" moves the deal on.

Your regulated customers' appetite, in your contract

Banks, insurers and other regulated firms carry their own duties to set risk appetite. When they rely on you, part of that appetite reaches you as contract terms. This does not bring you under the FCA, the PRA or DORA. Your customer is the regulated firm, and the contract is how it meets its obligations.

The terms are specific:

• PRA SS2/21. Supervisory statement SS2/21 applies to UK banks, building societies, PRA-designated investment firms and Solvency II insurers. Paragraph 6.4 expects written agreements for material outsourcing to set out agreed service levels with quantitative and qualitative performance criteria. They should also cover notice of developments that may affect the service, business contingency plans and their testing, and termination rights. Firms may limit termination rights to situations including those "that create risks beyond their tolerance".
• FCA SYSC 8.1. For common platform firms outsourcing critical or important operational functions, SYSC 8.1.8R sets conditions the firm must ensure. The provider must disclose developments that may materially affect its ability to perform. The firm and the provider must maintain a contingency plan for disaster recovery, and the firm must be able to terminate where necessary.
• DORA, for EU customers. The EU's Digital Operational Resilience Act, Regulation (EU) 2022/2554, has applied to EU financial entities since 17 January 2025. It is EU law, not UK law. Article 30 lists the contract terms for ICT services, including service level descriptions and, for critical or important functions, precise quantitative and qualitative performance targets. Article 6(8)(b) also requires those entities to set a risk tolerance level for ICT risk in line with their own risk appetite. That tolerance sits within their digital operational resilience strategy.

When a customer asks for a four-hour recovery time or a 24-hour breach notice, it is translating its appetite into your obligations. Your own appetite statement tells you whether you can accept that term, need to price it, or must decline it.

How do you write a risk appetite statement, step by step?

Write a risk appetite statement in six steps: choose the risk categories that matter to your business, write a plain statement of appetite for each, add measurable tolerances, assign owners, get board or founder approval, and set a review date. For a 25 to 150 person firm, the finished statement should fit on two pages.

1. Choose five or six risk categories. For a SaaS supplier, we recommend starting with security and data, availability, third parties and sub-processors, compliance, and product change, including AI features. Add a commercial or financial category if the board wants one. Fewer categories, used often, beat a long list nobody reads.
2. Write one statement of appetite per category. Use plain words and a level: low, moderate or high. Say what you will and won't accept, as the NCSC advises. "We have a low appetite for risks that could expose customer data" is a statement. "We take security seriously" is not.
3. Add measurable tolerances. Give each statement one to three numbers someone can check: an availability target, a patching window, a breach notification time, a limit on sub-processors without assessment. Take the numbers from what you already promise customers, so the statement and your contracts agree.
4. Name an owner for each category. The owner watches the tolerances, escalates breaches and signs risk acceptances within the category. At this size, the CTO, the head of operations and the person who owns compliance usually cover most categories between them.
5. Get it approved by the board or founders. Approval is what makes the statement an answer to a due diligence question. Minute it with a date. If you have no formal board, founder approval recorded in writing serves the same purpose.
6. Review it at least once a year and after big changes. A new market, a regulated customer, an acquisition or a serious incident should trigger a review. We recommend reviewing it alongside your ISO 27001 management review, so the two never drift apart.

The NCSC adds one point that is easy to miss: consider the cumulative risk you are accepting. Five risks each within tolerance can still add up to more than the business could absorb at once.

What does a risk appetite statement look like?

A risk appetite statement for a SaaS supplier is a set of short category statements, each with a level, one to three measurable tolerances and an owner. The examples below are illustrations of the format, written by GRCMANA. They are not benchmarks or requirements, and the numbers must come from your own contracts, architecture and board.

Illustration 1: security and customer data (low appetite). "We have a low appetite for risks that could lead to unauthorised access to customer data. Critical vulnerabilities on internet-facing systems are fixed within an agreed number of days. Any suspected personal data breach is reported to the affected customer within the time our contracts set. Owner: CTO."

As a processor, you must notify the controller of a personal data breach "without undue delay" under UK GDPR Article 33(2). Customer contracts may add a fixed deadline in hours, so set your tolerance to match the strictest term you have signed.

Illustration 2: availability (moderate appetite). "We accept moderate risk to availability in exchange for speed of delivery, within our contracted service levels. Monthly availability stays at or above the highest SLA we have signed. Recovery from a regional outage stays within our tested recovery time objective. Owner: Head of Engineering."

Illustration 3: product change and AI features (moderate appetite). "We have a moderate appetite for product innovation, including AI features, and a low appetite for features that process customer data in ways our contracts or privacy notices do not allow. No AI feature using customer data ships without a documented risk assessment and a data protection review. Owner: CTO with the Data Protection lead."

Notice that each statement does two jobs. It tells the team what to do, and it gives the customer a direct, checkable answer.

How does risk appetite drive day-to-day decisions?

Risk appetite drives four kinds of decision: whether to accept a risk, how to treat one that sits above tolerance, which key risk indicators to watch, and how to answer customers. Without a statement, each decision is made from scratch by whoever is in the room. With one, the decision has a rule and a named owner.

• Risk acceptance. A risk scored inside the tolerance can be accepted by its owner and recorded. A risk above it goes to treatment or to the board. This is how ISO 27001 risk acceptance criteria and the risk owner's sign-off under clause 6.1.3 connect.
• Risk treatment. The gap between a risk's score and the tolerance tells you how much treatment is needed. That, in turn, tells you how much the treatment is worth.
• Key risk indicators. Each tolerance suggests a metric to watch, such as open critical vulnerabilities, monthly availability, or sub-processors without a current assessment. When a metric approaches its limit, the owner acts before the line is crossed.
• Customer answers and contract terms. When a customer asks for a term, compare it with your tolerances. Inside them, accept. Close to the line, price the extra effort. Beyond capacity, decline or negotiate.

What are the common mistakes with risk appetite?

The most common risk appetite mistakes are copying a bank template, writing slogans instead of limits, leaving out metrics, never using the statement in real decisions and never reviewing it. Each one leaves a document that satisfies a checklist but fails the moment an auditor, a customer or an incident tests it.

• Copying a bank template. Bank statements cover capital, liquidity and credit risk. A SaaS supplier needs security, availability, sub-processors and product change. A borrowed template answers questions nobody is asking you.
• One-line slogans. "We have zero tolerance for security risk" sounds firm and means nothing, because no business operates at zero risk. It also gives an auditor an easy finding the first time you accept a risk.
• No metrics. A statement without numbers cannot be monitored, so it cannot drive acceptance decisions or key risk indicators.
• Never used for customer demands. If sales agree contract terms without checking them against the tolerances, the statement and your real commitments drift apart.
• Never reviewed. A statement approved two years ago, before your first regulated customer, describes a different business.

An appetite statement nobody has used to make a decision is a policy, not an appetite.

Kept short, measurable and approved, the statement does real work. It sets your ISO 27001 acceptance line, frames your SOC 2 risk assessment, and turns the board-oversight question on a questionnaire into a strength.

Frequently asked questions