Establish IT risk tolerance

Trigger: An annual IT governance review cycle begins or a significant shift occurs in the organization's business strategy or regulatory environment.

1. Review enterprise risk policies and strategic business objectives
2. Identify specific IT risk sub-categories
3. Model and quantify potential impact scenarios for identified IT risks
4. Define maximum acceptable loss limits and baseline risk thresholds
5. Present proposed IT risk tolerance metrics to executive leadership
6. Document and publish the formally approved IT risk tolerance levels

Outcome: Quantitative IT risk tolerance thresholds are formally approved and documented for strategic, operational, financial, and compliance categories.