Read ICANN Blogs to stay informed of the latest policymaking activities, regional events, and more.

ICANN Board Approves the Risk Appetite Statement

22 December 2020

I am pleased to announce that the ICANN Board has approved ICANN organization's first Risk Appetite Statement. The Risk Appetite Statement articulates the level of risk that the org is willing to take and retain in order to fulfill its mission. The Board also approved publishing a summary of the statement that identifies its purpose, defines risk, and sets forth ICANN's overarching Risk Appetite Statement. The development of this statement is the result of a multi-year process, and the Board is appreciative of the work and progress made by the Board Risk Committee and org staff.

Risk assessment is a key part of the work we do to ensure the furtherance of ICANN's mission. By fostering a risk-aware culture that extends throughout the organization and community, we become better prepared to identify, analyze, and mitigate risk on a broad level. The Board is regularly briefed on developments in the risk landscape and on emerging risks. The Board and the org's Executive team are ultimately responsible for knowing what risks the org faces and for approving an acceptable level of risk. The org leads the development of a robust risk management framework subject to Board oversight. The newly adopted Risk Appetite Statement is a crucial part of this overall framework.

Highlights from the Risk Appetite Statement

As a non-profit organization with a mission to ensure the security, stability, and resiliency of the Internet, the Risk Appetite Statement states that ICANN maintains a low risk appetite for risks directly related to its critical mission. The Risk Appetite Statement also indicates that the org maintains a low or medium risk-level appetite "to balance its operations with the resources required to manage the associated risks." Together, ICANN's overall risk appetite is "low to medium."

Background on the Risk Appetite Statement

ICANN org's Risk Appetite Statement was developed by the Risk Management team, and input from all teams was incorporated. It was then reviewed by the org's Executive team and approved by our President and CEO, Göran Marby, for consideration by the Board Risk Committee. Following discussion, the Board Risk Committee recommended that the Board adopt the final Risk Appetite Statement as noted above.

I invite you to review the posted summary and let us know what you think in the Comment section below.


Maarten Botterman

Maarten Botterman

ICANN Board Member