Exam CRISC topic 1 question 754 discussion

Because exceeding the capacity, means that the organization will go under. Appetite and tolerance are different. Tolerance is appetite + a little extra. From the book: Risk tolerance is defined as the acceptable level of variation that management is willing to allow for any particular risk as the enterprise pursues its objectives. The interpretation of the ISACA definition is that while management has an official acceptance level of one value, they may accept a slight deviation from that level. An example of tolerance is a situation where the speed limit on a highway is 65 miles/hour, but a police officer may allow a person to travel up to 70 miles/hour before issuing a ticket.

A. risk capacity. Prudent business practice dictates that risk appetite should not exceed an organization's risk capacity. Risk capacity is the maximum amount of risk that an organization can absorb without jeopardizing its ability to achieve its objectives. It represents the financial, operational, and strategic limits within which an organization can operate while still managing risk effectively. Risk appetite should be set below this threshold to ensure that the organization can handle the risks it takes on without exceeding its capacity to manage them.

Agree it is A. The review manual talks about appetite not exceeding capacity. I can see that appetite should not exceed tolerance, however tolerance is on a case by case basis whereas appetite and capacity are on organizational / overall basis. Also, if appetite exceeds tolerance you just stop having tolerance, it is only appetite at that point. Appetite could theoretically cancel tolerance, but could never cancel capacity.

I gotta go with A. Risk capacity: the amount and type of risk an organisation is able to support in pursuit of its business objectives. Risk appetite: the amount and type of risk an organisation is willing to accept in pursuit of its business objectives. Risk tolerance: organization's or stakeholders’ readiness to bear the risk after risk “treatment” in order to achieve its objectives

As per the below

PRUDENT business practice requires that risk appetite not exceed risk tolerance. exceeding capacity has nothing to do with prudence, if not with unconsciousness

Risk Capacity > Risk Tolerance > Risk Appetite (risk acceptance) . If organization crossed risk capacity its existence will be in danger. so option A is right

Risk Capacity then Risk Appetite then Risk Tolerance....... That's the hierarchy

Why the answer is not "C"?