COBIT 2019

Risk appetite establishes the amount and type of risk the enterprise is willing to accept in pursuit of its objectives. It provides the strategic boundary for IT governance decisions, controls, oversight, and risk responses. Risk tolerance defines acceptable deviation from that appetite, and a risk profile describes current exposure.