How can risk appetite, control effectiveness, and capital be judged in one framework?
Session 10 · ERQI Global Virtual Risk Summit
Tapestry: a unified governance, risk and financial decision analysis and intelligence framework
Jack Jones, Dr. Bob Mark & Andrew Shea
Overview
Cyber risk measurement is most useful when it connects to the thresholds, controls, and capital decisions the rest of the enterprise already uses. Jack Jones and Dr. Bob Mark join Andrew Shea to discuss Tapestry, an effort by the Enterprise Risk Quantification Institute (ERQI) to weave governance, cyber risk standards, and financial analysis together, and how the same machinery applies well beyond cyber.
Session 10 recording, ERQI Global Virtual Risk Summit 2026
Risk appetite as a working threshold
Shea traces Tapestry to a webinar series on NIST IR 8286, where Keyaan Williams described the work as a weaving. Jones argues that in cyber, risk appetite is mostly talked about and rarely used. Definitions are offhand and ambiguous, so measured loss exposure has nothing meaningful to be compared against. A defined threshold also tells you how much an audit finding matters: if fixing a deficiency would not change where you stand against appetite, he says, "I don't care what my subjective feelings about the findings are."
Mark describes how this works in a bank. Appetite is a matrix with businesses down the rows and risk types across the columns, with row and column totals below the sum of their parts to allow for portfolio effects. Going over a limit on purpose could cost a trader the job. His test: "If you're not paying attention to it, you don't have a good risk system."
Tying controls to returns
Mark's slide used RAROC: net return minus expected loss minus control cost, divided by economic capital. In his stylized example, 15 minus 7 minus 3 over capital of 25 gives 20%. Spend 6 on controls, cut expected loss to 4 and the tail to 10, and the figure rises to 50%, clearing a hurdle rate. Shea says this is why he has gravitated to RAROC for evaluating recommended controls, while noting that Mark reminds him other measures exist.
Jones supplies the controls side with FAIR-CAM, which he likens to physiology where a control library is anatomy. Effectiveness is not measured directly. It is a function of intended effectiveness, coverage, how often a control enters a variance condition, and how long it stays there. Often the fix is better coverage or a control that keeps breaking, not a new product. Mark shows how two preventive controls combine by multiplying their vulnerabilities, then carrying that through loss event frequency, loss mitigation, and Monte Carlo. Jones adds that correlated failures need attention.
Model risk and reach beyond cyber
Mark outlines two kinds of model risk, model error (wrong distribution, a dynamic system treated as stationary) and implementation, and describes independent validation and documented "vetting books." In a trading example, a 99% daily loss threshold implies about three exceedances a year, and regulators allow a green zone of up to four. Jones says that without a controls model, a missed forecast cannot be traced to its cause.
Both say the models are domain agnostic. Jones notes FAIR is built on loss event scenarios and first principles, and Mark applies this to climate risk, citing TCFD and a FEMA hazard database.
“If you're not paying attention to it, you don't have a good risk system.”
Dr. Bob Mark, on how banks treat risk appetite limits
Key takeaways
1
Give appetite a number
A defined threshold lets loss exposure and control findings be judged against something. Without it, measurement has little effect on decisions.
Watch at 8:302
Measure effectiveness as a function
Coverage, variance frequency, and variance duration say more than a checked box, and often point to cheaper fixes than a new control.
Watch at 24:133
Connect controls to returns
RAROC shows whether additional control spend improves risk-adjusted performance against a hurdle rate.
Watch at 14:484
Backtest and validate
Independent vetting, documentation, and tracking of exceptions apply to cyber models as they do in banking.
Watch at 41:005
Treat Tapestry as unfinished
Jones calls the work early and still in progress, and ERQI plans a home loan origination use case.
Watch at 57:11
