Risk appetite is the amount and type of risk that an organization is willing to accept in order to achieve its objectives. Risk appetite reflects the organization's risk attitude and its willingness to take on risk in specific scenarios. Risk appetite is usually expressed in a qualitative statement approved by the board of directors1.
Risk capacity is the maximum amount of risk that an organization can responsibly take on without jeopardizing its financial stability or other key objectives. Risk capacity is determined by objective factors like income, assets, liabilities, debts, insurance coverage, dependents, and time horizon. Risk capacity is usually expressed in a quantitative measure that sets the limit of how much risk the organization can handle2.
Prudent business practice requires that risk appetite not exceed risk capacity, because this would mean that the organization is taking on more risk than it can afford or sustain. If the risk appetite is higher than the risk capacity, the organization may face serious consequences such as insolvency, bankruptcy, reputational damage, legal liability, or regulatory sanctions. Therefore, the organization should align its risk appetite with its risk capacity, and ensure that its risk exposure is within its risk tolerance3.
The other options are not correct. Inherent risk is the level of risk that exists in the absence of controls or mitigations. It is the natural level of risk inherent in a process or activity. Residual risk is the level of risk that remains after the controls or mitigations have been applied. It is the remaining risk after the risk response has been implemented. Risk tolerance is the acceptable variation in the outcomes related to specific objectives or risks. It is the range of risk exposure that the organization is prepared to accept4. None of these concepts are directly comparable to risk appetite, and none of them represent the limit of how much risk the organization can take on. References =
* Risk Appetite vs. Risk Tolerance: What is the Difference? - ISACA
* What Is the Difference Between Risk Tolerance and Risk Capacity? - Investopedia
* Risk Management: Understanding Risk Capacity, Appetite, and Tolerance - Consulting Edge
* [CRISC Review Manual, 7th Edition]

A disaster recovery test is a simulation of a disaster scenario that evaluates the effectiveness and readiness of the disaster recovery plan. The main purpose of a disaster recovery test is to ensure that the organization can resume its normal operations as quickly as possible after a disaster, with minimal or no data loss. Therefore, the most important objective of a disaster recovery test from a business perspective is to verify that all critical data can be recovered within the RTOs, which are the maximum acceptable time frames for restoring the data and systems after a disaster. If the RTOs are not met, the organization may face significant financial, operational, and reputational losses. The other options are not the most important objectives of a disaster recovery test, although they may be beneficial outcomes. Gaining assurance that the organization can recover from a disaster is a subjective and qualitative goal, while recovering data within RTOs is a measurable and quantitative goal. Discovering errors in the disaster recovery process is a valuable result of a disaster recovery test, but it is not the primary objective. The objective is to correct the errors and improve the process, not just to find them. Testing all business critical systems is a necessary step in a disaster recovery test, but it is not the ultimate goal. The goal is to ensure that the systems can be restored and function properly within the RTOs.
References = CRISC Review Manual, pages 197-1981; CRISC Review Questions, Answers & Explanations Manual, page 572

Section: Volume D

The first step for the risk practitioner to address the situation of extended network outages that have exceeded tolerance is to recommend a root cause analysis of the incidents. A root cause analysis is a process of identifying and resolving the underlying causes of a problem or an event. By performing a root cause analysis, the risk practitioner can determine why the network outages occurred, what factors contributed to them, and how they can be prevented or reduced in the future. Recommending additional controls, updating the risk tolerance level, and updating the incident-related risk trend are possible steps that may follow the root cause analysis, but they are not the first step. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers, question 4; CRISC Review Manual, 6th Edition, page 153.