ARIS - SHARE YOUR IDEAS
Today there is no standard to document the risk appetite in ARIS. However, it is an important indication when managing risks.
Having the ability to document this (in a standard way), would enable further reporting and analysis about the risk situation.
An additional information captured by some customers is the 'impact of the control/measure' on the risk score. In combination with the risk appetite this enables the analysis if sufficient action is taken to manage the risk position of the company.
On the hierarchies, we have already added an attribute "Risk-bearing capacity", if I understand it correct, you would like to add that also on single risk level?
In my understanding, the impact of the control / measure is documented in the "reduced" values in the risk assessment - but i guess that is not what you mean?