Risk Appetite Without Metrics at a Payments Fintech

Weaknesses. The CISO's reporting line to the CTO blurs independent oversight: security is framed as an engineering cost center, not an enterprise risk function. The CTO chairs the steering committee, so the same executive sets priorities and judges performance. Business line owners are absent, which means product risk has no accountable owner. The board approved appetite language but no metrics, so it cannot govern. The 14 critical vulnerabilities and the 60-day launch are symptoms of decisions made without explicit trade-offs.

Decision rights. The board risk committee should own the appetite, approve any acceptance above a defined threshold, and receive quarterly independent reporting. The CISO should own the risk framework, policy, and escalation, with a dotted line or direct line to the board risk committee. The CTO should own remediation capacity and engineering standards, not risk acceptance. Business line owners should own risk in their products and sign launch risk decisions. The steering committee should be chaired by the CISO or COO, include business owners, and have authority to block launches when thresholds are breached. The compliance head should own regulatory mapping and evidence. Escalate to the board risk committee any regulatory finding open beyond 30 days, any critical vulnerability beyond 60 days, and any launch with unresolved high risk.

Translate appetite into thresholds. Regulatory non-compliance: zero unresolved regulatory findings older than 30 days; 100% of regulatory obligations mapped to controls; any credible regulator inquiry is red. Availability: monthly uptime at or above 99.9% for customer-facing services; recovery time objective misses are amber, two in a quarter are red. Innovation speed: launch cycle time target, but with mandatory security gates; any high residual risk accepted at launch is red unless approved by the CISO and business owner and reported to the board.

Escalation. Green: within thresholds, reported monthly. Amber: one threshold breached, remediation plan within 10 business days, reported to steering committee. Red: two consecutive amber periods, any regulatory finding over 30 days, any critical vulnerability over 60 days, or any launch with unaccepted high risk; escalate to board risk committee within 5 business days. Board dashboard. Show trend, not snapshots: open criticals by age, regulatory findings by age, availability, exceptions, and launch risk decisions. The key judgment is that the board should govern exceptions and trends, not every vulnerability. Thirty days is enough to publish the first dashboard if the data is pulled from existing ticketing and compliance trackers.

30 days. Produce the board paper with the governance fixes and a first dashboard. Assign named owners to all 14 critical vulnerabilities. Freeze new exceptions unless approved by the CISO and business owner. Convene a launch risk review for lending with compliance, engineering, and the business owner.

60 days. Run an independent launch gate: threat model, penetration test on the lending flow, control evidence for regulatory obligations, and a go/no-go decision. Where vulnerabilities cannot be remediated before launch, document compensating controls and a time-bound acceptance signed by the business owner and CISO, with board notification if residual risk is high. Reallocate the 12% cut toward the highest-risk items and automate evidence collection.

90 days. Present regulator evidence: oversight minutes, risk appetite metrics, remediation SLAs, and exception decisions. Prove that budget cuts changed scope, not accountability. The judgment is to protect the launch only if the risk is explicitly accepted and visible; a delayed launch with a credible remediation plan is better than a launch that undermines the board's regulatory position.