The Institute of Risk Management defines risk appetite as ‘the amount and type of risk that an organisation is willing to take in order to meet their strategic objectives’. An organisation’s sector often determines the extent of their risk appetite for different risks. For example, in financial services an organisation is likely to have a lower risk appetite to fraud and security risk.