Risk appetite vs Risk profile

Risk management

How much risk leadership is willing to live with to reach the company's goals.

Formal

A leadership decision stating the amount and type of risk an organisation will accept, used as the line that decides whether a risk needs further treatment.

In plain English

Like how fast you are willing to drive - some people accept more danger to arrive sooner, others do not.

In practice

A pension fund's board writes down that it accepts no risk of losing members' data, but will live with short outages of the internal chat, and the IT security manager plans controls to match.

Why it matters

Without a stated limit, every risk decision becomes a matter of opinion, and leadership cannot be held to account.

Risk profile

Risk management

The overall picture of which dangers an organisation faces and how serious they are, given its size, sector, data and systems.

Formal

A description of the full set of risks an organisation carries at a point in time - shaped by its sector, size, critical assets, the outside services it relies on and its threat landscape - used to decide which controls come first.

In plain English

Like packing for a trip - a week of camping by the sea and a weekend in a city hotel call for very different bags, even for the same traveller.

In practice

A small dental clinic with patient records and one server has a very different profile from a wind turbine maker with factories and suppliers worldwide, so the two start with different CIS Controls.

Why it matters

Copying another organisation's plan wastes money; knowing your own profile lets limited resources go where they matter most.