A twist on risk appetite
The standard definition of risk appetite is “the amount of risk you are willing to take in the pursuit of objectives”.
cyber breach
IT audit and IT risk
IT security is fundamental to achieving business objectives—which means that understanding and managing IT risk is also fundamental to achieving business objectives.
Treat cyber as a business risk
If you want to treat cyber as another business risk, then it needs to be assessed and evaluated in a way that you can compare it to and aggregate its effect with other sources of business risk.
