The cascade exists because a board statement, however precise, decides nothing by itself — decisions are made daily by people three or four levels below. Cascading translates the board's intent into limits, tolerances and targets that each of those levels can actually apply. The dependent decision is delegation: the board can hand authority down only when it knows daily choices are bounded by its own appetite. Without the cascade, appetite remains an opinion, not a control.
The cascade is usually built by the risk function together with business owners and refreshed whenever the appetite statement is reviewed, typically annually. It lives in policy limits, procurement rules, service-level thresholds and KRI trigger levels. Example: a board appetite of "no critical service outage beyond 4 hours" cascades into an IT recovery time objective of 2 hours, a supplier contract clause on 24-hour spare-part delivery, and a KRI flagging any component with a single source. Each layer must be traceable back to the sentence in the appetite statement it serves.
The classic gap is a well-crafted appetite document at the top and unchanged operational limits below — old credit limits, old inventory rules, old outsourcing decisions, none of them re-derived from the new appetite. Auditors find the disconnect quickly; disruptions find it faster. The mechanics of cascading appetite into resilience limits are worked through in module M2 "From enterprise risk management to business resilience" of the ERGP programme.
This term is part of the working language of ERGP — the first resilience governance certification fully available in Arabic, also in English. 94 chapters, six modules, a verifiable certificate.
Explore the ERGP programme