An organisation states a risk appetite and teams still make inconsistent decisions. What is missing?
Show the full answer Hide the answer
What is missing
Expression in terms a team can apply at the moment of decision. "We have a low appetite for operational risk" cannot be applied to a specific choice — two engineers can reach opposite conclusions and both believe they complied.
An appetite that has never caused anyone to decide differently is a statement rather than a constraint.
What makes it actionable
- Thresholds, in the units of the decision: the maximum acceptable expected annual loss for a category, the maximum customer impact of a single change, the availability target per journey, the maximum exposure a single credential may create.
- Stated per journey or per capability, since applying one appetite to trading and to reporting means either over-investing in one or under-investing in the other.
- Tied to a mechanism: an error budget, a capacity threshold, a value limit, a review trigger. The mechanism is what makes the appetite operate, and without one it is documentation.
- With a defined route for exceeding it — a named accepter, a rationale and a review date — since decisions outside appetite will be made and the question is whether they are visible.
The specific version in a volatile market
Appetite must account for correlation. In a crypto or trading business, the volatility that drives volume also degrades every dependency simultaneously — so an appetite calibrated on average conditions is calibrated on conditions that do not matter.
The design point is the correlated bad day, and the appetite should be expressed against it: what loss, what unavailability and what degradation are acceptable when everything is stressed at once.
The connection to architecture
Appetite determines what is worth building. A stated tolerance for an hour of unavailability on a given journey removes the argument for an expensive failover; a stated intolerance justifies it.
Without the number, the argument is a matter of taste and is won by whoever is most persistent — which is the actual mechanism by which most reliability investment is currently allocated.