Board Risk Appetite Report

Risk findings have no inherent severity. A control gap becomes Critical, High, Moderate, or acceptable only in relation to an organization's stated tolerance for the underlying risk. Yet many assessments begin with technical testing before the Board has explicitly articulated risk appetite. The result is predictable: findings are scored using generic scales, remediation priorities become subjective, and management cannot clearly demonstrate that risk decisions align with Board expectations. This engagement established the governance baseline before assessment conclusions were produced.

1 — Elicit. Five Board members independently assessed 30 questions across six risk domains: Cybersecurity Operations, Data Protection & Privacy, Third-Party / Vendor Risk, Business Continuity & Disaster Recovery, Regulatory Compliance, and AI & Emerging Technology. 2 — Quantify. Responses were converted into domain-level Risk Appetite Indices using a 1–5 scale from Zero Tolerance through Aggressive. 3 — Surface Divergence. Material differences between directors were explicitly identified rather than averaged away. Disagreement is governance information. 4 — Resolve. Where director responses materially diverged, facilitated discussion converted disagreement into explicit governance decisions. 5 — Adopt. The resulting positions were formalized through Board motions establishing risk thresholds, AI governance posture, incident expectations, and decision boundaries. 6 — Operationalize. Those decisions were translated into severity-calibration rules used by downstream risk assessments.

Averages can conceal material disagreement. A Board scoring 1, 1, 1, 5, 5 does not have a risk appetite of 2.6. It has a governance disagreement. The methodology therefore identifies divergence explicitly and requires resolution before an appetite baseline becomes authoritative. Directors who hold strongly divergent views must either persuade their colleagues, accept the majority position through formal motion, or document their dissent — not disappear into an average.

Board Questionnaire — captures individual risk perspectives ↓ Risk Appetite Index — quantifies consensus and exposes divergence ↓ Board Motions — convert discussion into authoritative governance decisions ↓ Severity Calibration Framework — turns Board intent into assessment and remediation rules The engagement resulted in five formal Board motions defining risk tolerance, AI governance posture, and incident-response expectations. These decisions became the governing baseline for all subsequent assessment activity.

Board Intent → Risk Appetite → Severity Calibration → Assessment Findings → Remediation Priority → Risk Acceptance / Escalation A Partial control rating is therefore not assigned an arbitrary severity. Its significance is evaluated against the Board's documented tolerance for the affected risk domain. Every remediation decision can be traced upward to governance authority. This report sits upstream of all other assessment work. The Control Profiler structures what controls exist. The CRI Coverage Assessment determines whether those controls satisfy framework requirements. But the severity of any gap — and the urgency of its remediation — is anchored here, in the Board's stated appetite.

Risk severity should not begin with the assessor. It should begin with the Board. How risk appetite creates the governance foundation that makes everything else defensible. Why surfacing disagreement is more valuable than manufacturing consensus — a 2.6 average conceals a governance problem that formal motions resolve. How I facilitated Board consensus where directors initially disagreed. The connection between appetite thresholds and remediation prioritization — without appetite, every finding is equally urgent. How Board Risk Appetite, Control Profiler, and CRI Assessment form one governed pipeline: governance intent → structured controls → evidence-based assessment → calibrated risk decisions.