Importance of Risk Appetite 221 f I g u r E 20.5 Risk management and uncertainty Increasing gain Opportunity management Increasing hazard tolerance Increasing opportunity investment Hedging or JVs Risk response and loss control Internal control Insurance Increasing loss Hazard tolerance Control acceptance Opportunity investment Exposure before risk control measures Exposure after risk control measures The approach based on the identification and evaluation of critical controls is closely aligned to the activities of the internal audit. It is worth remembering that internal auditors prefer to undertake a risk assessment of the inherent level of risk, assuming that there are no controls in place. This is a valuable approach, because it identifies critical controls. The difficulty is that it is sometimes impossible to identify the inherent level of risk, or it is sometimes the case that such an approach is not helpful because it becomes too theoretical. Around the risk appetite, there would be a range of possible risk exposures that represent the limits of the risk exposure that is acceptable to the organization. This