Low Appetite. 90-Day Deferral. Inside Tolerance or Outside? Nobody Could Say.
Sharp. Not sentimental.
Low Appetite. 90-Day Deferral. Inside Tolerance or Outside? Nobody Could Say.
A bank's CISO received a request from the product team to defer a critical security patch for 90 days. The patch addressed a known vulnerability. The deferral would allow a major product launch to proceed without the disruption of a mandatory system update.
The CISO consulted the risk appetite framework. It said the organisation had a 'low appetite for cyber risk with a focus on maintaining robust controls across all critical systems.'
The question the CISO needed answered was specific: is 90 days of known unpatched vulnerability in a critical system inside or outside the organisation's stated appetite? The framework could not answer it. 'Low appetite' and 'robust controls' are orientations. They are not thresholds. They cannot tell a decision-maker whether a specific deferral, at a specific duration, for a specific risk class, is acceptable or not.
The CISO escalated. The decision took three weeks and reached the board. It should have taken three hours and stayed with the CRO.
Honest. Not accusatory.
Risk Appetite Statements Describe Orientation. Only Thresholds Produce Decisions.
The gap between 'low appetite for cyber risk' and 'you can accept a residual likelihood of medium, residual impact of low, for a risk in the information security class, for up to 30 days, without escalating' is the gap between a governance document and a decision tool.
Most appetite frameworks live on the wrong side of that gap. They are written at the level of strategic intent — the kind of language that works in a board ratification paper and is meaningless in an operational decision. Nobody can use 'low appetite' to answer the 90-day question.
Calibration is the process of translating appetite orientation into decision thresholds. It is not a framework revision exercise. It is a specific, structured conversation about what 'low' means in practice — in numbers, in durations, in conditions — for each risk class the organisation has defined.
Simple. Not simplistic.
The Threshold Calibration Model: Four Parameters Every Risk Class Needs.
For each risk class in the taxonomy, four parameters convert the appetite statement into a decision tool. Together they tell a decision-maker whether they can act, at what level, and when they must escalate.
| PARAMETER | WHAT IT SPECIFIES | EXAMPLE FOR CYBER / INFORMATION SECURITY |
|---|---|---|
| Maximum residual exposure | The highest residual risk position the organisation will tolerate in this class without a specific board decision. | Medium likelihood, low impact, for risks with effective controls in place. |
| Maximum uncontrolled duration | The longest period a known control gap can remain open before it triggers escalation regardless of current residual rating. | 30 days for critical systems. 90 days for non-critical systems. Zero tolerance for active exploitation. |
| Decision authority | The role and level authorised to accept residual positions up to the maximum, and the role that must approve exceptions. | CRO authority up to maximum. Board approval required for any known gap in a critical system beyond 30 days. |
| Evidence standard | The minimum documentation required when the decision right is exercised at any level. | Written rationale, named decision-maker, timeline to resolution, control plan. Filed in the decision record within 24 hours. |
With these four parameters in place, the CISO's question answers itself: a 90-day deferral on a critical system exceeds the maximum uncontrolled duration, requires CRO approval at minimum, and must be documented with a control plan. The escalation is appropriate. The decision right is clear. The question no longer requires three weeks.
Practical. Not obvious.
Calibrate One Risk Class Before the Next Appetite Review.
Pick the risk class where your appetite framework is most frequently used to make operational decisions. Apply the four parameters.
If the four parameters produce answers that would have resolved last quarter's decision in three hours rather than three weeks, the calibration is working.
If the parameters surface a debate about what 'low appetite' actually means in practice, that debate is the governance work. Have it now, in a planning meeting. Not in a crisis, when the product launch is running and the patch is pending.
Open. Not pushy.
The Decision Infrastructure Self-Assessment
The appetite-to-decision link is one of four connections mapped in this assessment. It identifies where the appetite framework stops producing decisions and starts producing discussions instead.
Access here →Book a 45-Minute Decision Architecture Conversation
If the calibration exercise surfaced a debate about what 'low appetite' means for your most-used risk class, bring it. A diagnostic session turns that debate into four documented parameters.
Book a diagnostic session →That's The Decision Layer for this week.
The CISO's 90-day question was not unreasonable. The framework was. An appetite statement that cannot answer a specific question is doing the board's job poorly.
Forward this to whoever owns the risk appetite framework in your organisation. The four-parameter exercise takes an afternoon. The calibration it produces lasts for years.