CRISC: Certified in Risk and Information Systems Control

Risk management is effective when residual risk is brought within the organization’s established risk appetite—the amount of risk it is willing to accept while pursuing its objectives. Risk capacity defines the maximum loss an organization can withstand, not the operating target for accepted residual risk.