Without an explicit risk appetite, every security decision becomes a fresh argument and every 'no' feels arbitrary. Defining what risk the organization will and won't accept turns endless negotiation into consistent, defensible decisions.
“Undefined risk tolerance means infinite debate.”