The ISO 31000 risk management standard refers to risk appetite as the amount and type of risk that an organization is prepared to pursue, retain or take. An operational risk appetite is the amount of operational risk that an organization is prepared to pursue, retain, or take.