Risk Optimization
Risk Optimization tests whether you can align IT risk with enterprise risk appetite and optimize risk rather than simply minimize it. Expect risk appetite, tolerance and capacity, risk profiles and scenarios, response options, KRIs, third-party risk and integration with ERM.
Core rules
- Risk appetite is the amount and type of risk an enterprise is willing to pursue or retain; risk tolerance is the acceptable deviation around a specific objective; risk capacity is the maximum risk it can bear.
- COBIT 2019 treats risk as including upside and opportunity, not only loss.
- EDM03 Ensured Risk Optimization sets direction; APO12 Managed Risk executes; MEA03 monitors compliance.
- Responses: avoid, reduce, share/transfer, accept-and exploit for opportunity.
- A risk register needs an owner, cause, event, impact, likelihood, response, residual risk and due date. A register without owners is a compliance artefact.
- Risk scenarios combine threat, vulnerability and impact; KRIs are forward-looking thresholds, not lagging incident counts.
- IT risk must aggregate into enterprise risk, not sit in a separate IT silo.
Worked example
A bank migrates customer analytics to a SaaS provider that may replicate data outside the country. Appetite: the board statement prohibits customer data processing outside the jurisdiction. Tolerance: zero for regulatory breach. Capacity: limited ability to absorb fines and reputational damage. Response: choose an in-country region, add contractual data-residency and audit rights, encrypt data, and document an exit plan. Residual risk is accepted by the business owner, not IT alone. KRIs: percentage of data outside the approved region and failed attestations. That is risk optimization within appetite-not blanket avoidance of cloud.
Traps
- Using appetite and tolerance interchangeably.
- Treating risk as only downside and ignoring opportunity.
- Keeping IT risk outside the enterprise risk register.
- Writing a register with no risk owners or residual rating.
- Assuming transfer removes risk; accountability usually remains.