Risk appetite is defined with reference to how the entity creates, preserves and realizes value. There is no universal or right appetite; management and the board choose it knowing what is being traded off, and take into account the entity's risk profile and risk capacity and how capable and mature its enterprise risk management is, and expressing it in financial parameters (acceptable variation in performance, return targets, debt rating) and operating parameters (safety, quality, environmental targets, customer concentrations); it may be articulated as a point or a continuum, in statements aligned with strategy and business objectives that cascade from the entity to the objectives, or by risk category, and is communicated broadly; it guides the allocation of resources across the entity and its units and is applied through strategy development and objective-setting, aids decision-making and portfolio-level evaluation, and ties strategy to measures, while tolerance applies in implementation to variation from plan and limits, indicators and triggers apply to specific risks.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.