CRISC: Certified in Risk and Information Systems Control

Risk management should prioritize and treat risks so that residual exposure remains within the organization’s risk appetite. This allocates controls and resources where they are justified, instead of attempting to eliminate all risk regardless of cost. ISACA defines risk appetite as the amount of risk an entity is willing to accept in pursuing its mission and identifies managing risk within that appetite as a core risk-management objective.