ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
Business continuity risk appetite is the amount and type of disruption an organization is prepared to accept in pursuit of its objectives, and it sets the line between risks that can be lived with and risks that need action. Without a clear statement, continuity spending is driven by whoever argues loudest.
This guide explains how to define business continuity risk appetite, how it differs from tolerance and capacity, and how to link it to your risk criteria and risk treatment decisions. For the general concept, see our overview of risk appetite.
Appetite is a statement of attitude: how much disruption leaders are willing to carry. Tolerance is the measurable limit for a specific objective, such as the longest outage of a service. Capacity is the most disruption the organization could absorb before survival is at stake.
ISO 31000, listed at ISO 31000 on iso.org, describes risk criteria as the terms of reference for evaluating significance, and appetite sits behind those criteria.
Continuity resources are finite. A stated appetite tells teams which activities deserve redundancy and rapid recovery, and which can wait. It also protects staff from unrealistic demands that everything be restored at once.
When appetite is unclear, plans tend to be either too costly or too weak, and neither is easy to defend to auditors or to the board.
The board or top management owns appetite because it reflects strategy, regulation and stakeholder expectations. The continuity lead drafts options, based on impact analysis findings, and the executive team approves.
Record the approval date and review cycle so the statement is treated as a controlled document.
Keep the evidence file alongside the statement so leaders can see the data behind each limit when they review it.
The business impact analysis provides the facts: which activities matter most, how quickly harm accumulates and what the maximum tolerable period of disruption is. Use these results to propose tolerance limits for each activity. The guide to the maximum tolerable period of disruption describes the method.
Free business impact analysis
How long can each activity really be down?
Rate the impact of an outage over time, set RTOs and maximum tolerable periods of disruption, map the people, systems and suppliers behind each activity, and get a recovery sequence back, free.
Run the free business impact analysis → or View premium report sample
Appetite statements without this evidence tend to become slogans.
| Activity type | Appetite statement | Tolerance limit | Escalation |
|---|---|---|---|
| Customer-facing critical service | Very low | Recovery within 2 hours | Executive if exceeded |
| Core back-office process | Low | Recovery within 1 day | Director |
| Supporting process | Moderate | Recovery within 3 days | Department head |
| Non-essential activity | High | Recovery within 2 weeks | Owner |
Use plain language and measurable wording. For example: the organization has very low appetite for disruption to customer payment services, and will not accept an outage beyond two hours. State the scope, the level and the reason.
Avoid vague terms such as “minimal” without a definition, and make sure statements do not contradict each other across activities.
Appetite can vary by cause as well as by activity. An organization may accept short technology outages more readily than loss of a building, or may have almost no appetite for events that endanger people. Separate the main disruption types: loss of premises, technology, people and suppliers. For each, state the attitude and note any exceptions. This nuance helps planners decide where to invest in resilience first.
It also prevents a single blunt statement from being applied to situations it was never meant to cover.
For each critical activity, define the maximum outage, the minimum service level during recovery and the acceptable data loss. These link directly to the recovery objectives in the guide to RTO and RPO.
Limits give plans something to be tested against, and a breach of a limit becomes a clear trigger for escalation.
Sometimes a risk will exceed tolerance for a period, for example while a new recovery site is built. Allow a documented exception with a named approver, compensating measures and an expiry date. Track open exceptions in the risk register and report them at each management review. Exceptions with no end date quietly turn into a new, unapproved appetite, and auditors notice the difference between a temporary exception and a permanent breach.
Free business continuity risk assessment
What could stop your most important activities?
List your prioritized activities and what they depend on, pick from 32 disruption scenarios, rate them and choose continuity measures for each. Built to ISO 22301 clause 8.2.3, and free.
Run the free continuity risk assessment → or View premium report sample
Map appetite to the thresholds in your criteria. Very low appetite means even moderate scores need treatment or senior approval, while high appetite allows owners to accept more. The table in this article shows one way to align appetite with tolerance and escalation.
Test the mapping on real risks to check that the outcome feels sensible to leaders.
Appetite also constrains spending. A very low appetite for outage may require duplicate sites, hot standby systems and multiple suppliers, which cost money every year. Compare the cost of each option with the loss it avoids and with the tolerance limit. If the cost is beyond reach, leaders must either fund it or accept a higher appetite, and that trade-off should be recorded. Making the choice visible avoids the false comfort of an ambitious statement with no funded arrangements behind it.
When a risk exceeds tolerance, choose to treat, transfer, avoid or formally accept it with approval. Appetite guides how much treatment cost is proportionate: high spend on a very-low-appetite service is justified, while the same spend on a supporting process may not be. Our guide to continuity risk treatment covers the options.
Examples make the idea concrete. A payments firm might write: “We have very low appetite for interruption to customer payment processing and will not accept an outage longer than two hours or any loss of confirmed transactions.” A manufacturer might write: “We have low appetite for loss of production at our main plant beyond one shift, and moderate appetite for delays to non-critical maintenance.” A public body might write: “We have very low appetite for failure of services that protect vulnerable people, and moderate appetite for delays to administrative services.” Each statement names an activity, an attitude and a limit. Use them as starting points, then adapt to your own obligations and evidence.
Watch for these problems.
Some limits are not a free choice. Financial and critical infrastructure regulators may set expectations for operational resilience, and customer contracts may fix service levels with penalties. Collect these obligations before drafting the statement and treat them as minimum constraints. Where a customer requires recovery within four hours, an appetite that tolerates a full day for that service would be inconsistent. Cross-check every statement against current obligations at each review.
Insurance can transfer part of the financial loss from a disruption, but it does not restore service or protect reputation. When drafting the statement, distinguish between financial appetite, which insurance may help with, and operational appetite, which it does not. Check policy exclusions, waiting periods and sub-limits so leaders understand what cover actually delivers. Include the findings in your appetite paper so decisions rest on an accurate picture rather than on an assumption that insurance solves everything.
Where cover depends on having tested plans, note the requirement and track compliance.
Review appetite annually and after major change such as a merger, new regulation or serious incident. Test it in scenario exercises: if the scenario shows the business cannot meet its tolerance, decide whether to invest or to change the statement. See the guide to scenario planning for how to run these sessions.
An approved statement helps only if people know it. Publish it on the intranet, include it in induction for risk owners and refer to it in continuity training. Use plain wording and concrete examples so managers can apply it to daily decisions, such as whether to accept a single supplier for a component. Ask owners for feedback after the first review cycle and adjust anything that proved unclear or unrealistic.
Attach the appetite statement to the register and the criteria so every assessor works from the same reference. If you want a ready structure, the Business Continuity Risk Assessment Report and Workbook includes fields for tolerance, scoring and approval, and it helps keep one consistent record across assessments.
It is the level of disruption an organization is prepared to accept while pursuing its objectives, expressed as statements and limits.
Appetite is the general attitude, while tolerance is the measurable limit for a specific activity or objective.
The board or top management, using evidence from the impact analysis prepared by the continuity lead.
Yes. Critical customer services usually justify lower appetite than supporting processes.
At least annually and after major changes to strategy, regulation or the business.
September 30, 2026
