Why Every Department Defines “High Risk” Differently

RISK MANAGEMENT  |  ROOT CAUSES SERIES

Written by: Devensa AI.

Executives feel the pressure: 74% reported a significant operational surprise in the past five years, and 69% see rising risk volume and complexity. Far fewer have the shared structure to respond, with 29% holding a formal risk appetite and 11% seeing strategic advantage from risk management.¹

Departments define “high risk” differently because most organizations never set a shared risk appetite or a common scoring scale. Finance scores by dollars, security by exploitability, operations by downtime. The 2026 State of Risk Oversight study from NC State and the AICPA found only 29% of organizations have formally articulated risk appetite in the context of strategic planning.¹

Five Departments, Five Meanings of “High”

Ask five department heads to rate the same event and the answers diverge fast.

Finance calls a risk high when the expected loss crosses a budget threshold. Security calls a vulnerability high when the CVSS score passes 7.0, regardless of what the affected system holds. Legal calls a matter high when a regulator might act. Operations measures in hours of downtime. Product worries about a missed launch window.

Take one event: a payment vendor goes offline for six hours. Operations rates the outage high because checkout stopped. Finance rates the event medium because lost revenue stayed under the quarterly threshold. Security rates the event low because no data left the building. Legal has no rating at all until a customer complains. Four teams, one incident, four conclusions about whether leadership needs to hear about the outage before Friday.

Each scale makes sense inside one department. The problem starts when the five lists roll up into one enterprise heat map. A red cell from security and a red cell from finance look identical on the slide, though one represents a $50,000 exposure and the other a regulatory action. The board reads both as equal.

Risk Appetite Is the Translation Layer

Risk appetite is the amount and type of risk an organization accepts in pursuit of its objectives. Risk tolerance turns appetite into specific thresholds: a maximum loss, a minimum uptime, zero tolerance for a category of regulatory breach.

COSO’s 2017 framework, Enterprise Risk Management: Integrating with Strategy and Performance, organizes ERM into five components and 20 principles. Defining risk appetite sits in the Strategy and Objective-Setting component.² Appetite comes before scoring, because scores mean nothing without a shared reference point.

The misconception treats risk management as a register: collect risks, color them, file the spreadsheet. A register without an agreed appetite becomes a list of departmental opinions. ERM done properly connects every rating back to what the organization decided to accept.

What Inconsistent Definitions Cost

Surprise

In the 2026 study, 74% of executives reported a significant operational surprise within the past five years, and 69% said the volume and complexity of risks increased over the same period. Only 30% described their risk oversight as mature or robust.¹ The authors pointed to siloed risk processes as one barrier to seeing how risks connect.¹

The 2026 State of Risk Oversight, the 17th annual study from NC State University’s ERM Initiative and the AICPA, surveyed 331 executives and board-level leaders in the second quarter of 2026.¹

Limits nobody respected

Credit Suisse lost $5.5 billion when Archegos Capital collapsed in 2021. The independent investigation by Paul, Weiss found numerous warning signals, including large and persistent limit breaches, which risk managers and senior executives failed to act on.³ Archegos also received temporary, bespoke increases to its risk appetite, including one of $900 million.⁴

The bank had limits. The business treated them as negotiable, and the risk function lacked the standing to hold the line. When one unit’s “high” becomes another unit’s “manageable,” the limit stops working.

Strategy disconnected from risk

Only 11% of executives in the 2026 study said risk management gives their organization a unique strategic or competitive advantage.¹ Without a shared definition of high, risk information never reaches the strategy table in a usable form. In the Devensa vC-Suite model, building the shared definition belongs to the vCRO, the AI-powered virtual officer for enterprise risk governance and executive risk reporting.

COSO ERM Meets TruMaturity™

Devensa.AI scores Risk Management as one of six domains on the TruMaturity™ framework. The AI-mediated assessment produces a Risk Management Domain Maturity Score on the CMMI scale, 1 Initial, 2 Developing, 3 Defined, 4 Managed, 5 Optimized, plus an Overall Effectiveness Score across all six domains.

Because all six domains share one scale, a Cybersecurity score and a Compliance score mean the same thing at the same level. The tenant sets a target per domain. The gap becomes a roadmap, prioritized by risk, with each item assigned to the domain whose score the item improves.

The Parts of One Risk Language

A single impact scale in business terms. Define each level across dollars, customers affected, regulatory consequence, and operational disruption. A “4” means the same thing in every department.

Likelihood with a time horizon. “Likely” within 12 months, not “likely” at some point.

Tolerance thresholds per category. Written limits for financial, operational, compliance, and reputational risk, approved by the board.

Escalation rules. A breach of tolerance goes to a named executive within a set number of days. Exceptions carry an expiration date and a signature.

One register. Every department feeds the same register using the same scale. Departmental views become filters on shared data.

Where to Start

1. Collect the scoring scale each department uses today. Put them side by side. The differences become the first agenda.
2. Draft a one-page risk appetite statement with the executive team, then take the draft to the board for approval.
3. Rebuild the impact scale in business terms and retrain risk owners on the new definitions.
4. Re-score the top 20 enterprise risks on the new scale. Expect the ranking to change.
5. Track limit exceptions as a reported board metric, with owners and expiration dates, not a footnote.

Frequently Asked Questions

What is the difference between risk appetite and risk tolerance?

Risk appetite is the broad amount and type of risk an organization accepts to pursue its objectives. Risk tolerance sets measurable thresholds around specific metrics, such as a maximum acceptable loss or a minimum system availability. Appetite sets direction. Tolerance makes direction enforceable.

Why do risk heat maps mislead boards?

Heat maps compress different departmental scales into the same colors. A red rating from security and a red rating from finance often represent far different exposures. Without a common impact scale tied to risk appetite, the map ranks departmental emphasis instead of enterprise exposure.

Which framework helps standardize risk definitions?

COSO’s 2017 ERM framework places defining risk appetite inside its Strategy and Objective-Setting component.² ISO 31000 offers a parallel approach built on establishing risk criteria. Either works when leadership commits to one scale across the organization.

How common is a formal risk appetite statement?

Less common than most boards assume. The 2026 NC State and AICPA study found 29% of organizations have formally articulated risk appetite in strategic planning.¹

How does Devensa.AI help align risk definitions?

The platform scores all six governance domains on one CMMI-based TruMaturity™ scale, so maturity levels mean the same thing across Cybersecurity, AI Governance, Risk Management, Compliance, Privacy, and Data Governance. AI-generated recommendations route through human approval before anything gets published or acted on. If five of your department heads rated the same risk tomorrow, how many different answers would you get?

Sources

1.     NC State University ERM Initiative and AICPA, 2026 State of Risk Oversight: An Overview of Enterprise Risk Management Practices, 17th Edition, September 9, 2026. https://erm.ncsu.edu/resource-center/2026-state-of-risk-oversight-enterprise-risk-management-trends-and-key-findings/

2.     COSO, Enterprise Risk Management: Integrating with Strategy and Performance (2017), summarized in Risk Management in Supply Chain, eCampusOntario. https://ecampusontario.pressbooks.pub/riskmgmtsupplychain/chapter/3-3-coso-enterprise-risk-management-erm-framework/

3.     Paul, Weiss, Rifkind, Wharton & Garrison, report on Credit Suisse and Archegos, July 2021, as reported by CNN Business. https://edition.cnn.com/2021/07/29/investing/credit-suisse-archegos-report

4.     Paul, Weiss report on Credit Suisse and Archegos, as reported by The TRADE. https://www.thetradenews.com/?p=79792

This article is provided for informational purposes only and does not constitute legal or compliance advice. Consult qualified counsel before making governance decisions.