Does your organization have a formal process to periodically review and update its risk appetite and objectives based on current risk exposure and residual risk levels?

This question assesses whether your organization regularly evaluates and adjusts its risk tolerance thresholds and strategic objectives in response to changing threat landscapes and actual risk exposure. As business conditions, technologies, and threats evolve, organizations need to recalibrate their risk appetite to ensure security controls remain aligned with business priorities and acceptable risk levels. Without this periodic refinement, security controls may become misaligned with actual business needs or fail to address emerging risks adequately. Evidence of compliance could include documented risk appetite statements with revision history, minutes from risk committee meetings showing periodic reviews, formal reports comparing actual risk exposure against defined thresholds, or updated risk management policies with approval dates and signatures from executive leadership.