CRISC Risk Calculator
Risk Appetite, Three Lines of Defense, and Risk Assessment Tools
Risk Appetite, Tolerance & Capacity
Visualize the relationship between how much risk your organization CAN take, WILL take, and ALLOWS to vary
Risk Appetite
Amount of risk the organization is willing to accept. Set by Board/Owners.
Risk Tolerance
Acceptable variation from appetite. Allows occasional approved deviations.
Risk Capacity
Maximum loss the org can take without failing. The absolute limit.
Three Lines of Defense Model
- Owns and manages risks
- Implements internal controls
- Day-to-day risk decisions
- Maintains control environment
- Business unit level responsibility
- Oversees risk management
- Develops policies & frameworks
- Monitors first line controls
- Compliance monitoring
- Risk practitioner operates here
- Independent assurance
- Objective reviews
- Evaluates 1st & 2nd lines
- Reports to Board/Audit Committee
- Validates risk management design
Key Insight: Risk practitioners work across the first TWO lines of defense. Auditors in the third line provide information TO risk practitioners for board reporting.
Risk Assessment Calculator
Risk Score = Likelihood × Impact. Click on the matrix or use the form below.
Risk Details
Risk Result
Monitor and review regularly. Consider mitigation controls.
Risk Register
Track and manage identified risks. Add risks from the Risk Matrix tab.
| Risk ID | Risk Name | Likelihood | Impact | Score | Level | Treatment | Actions |
|---|---|---|---|---|---|---|---|
| No risks registered yet. Go to the Risk Matrix tab to add risks. | |||||||