The risk appetite statement must articulate at least the degree of risk the RSE licensee will accept in pursuit of its strategic objectives and business plan having regard to the interests of beneficiaries, for each material risk the maximum level it is willing to operate within expressed where possible as a measurable residual risk limit after allowing for mitigants, the process for setting risk tolerances at an appropriate level based on estimated impact on beneficiaries of a breach and the likelihood of the risk being realised, the process for monitoring compliance with each tolerance and acting on a breach, and the timing and process for reviewing appetite and tolerances.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.