Risk Appetite and Tolerance — The Foundation of Risk Decisions

Risk Appetite Sets the Speed Limit; Risk Tolerance Is the Range at Which Enforcement Happens

The Critical Distinction

Risk appetite and risk tolerance are frequently confused but serve different purposes :

Think of risk appetite as the speed limit and risk tolerance as the range at which enforcement happens .

Risk Appetite

Definition: The amount of risk an organization is willing to accept in pursuit of its objectives.

Characteristics:

• Board-level decision
• Strategic
• Often expressed qualitatively (e.g., "We are risk-averse" or "We are risk-tolerant")
• Should be documented and approved

Examples:

• "We will not accept risks that could result in material financial loss"
• "We are willing to accept moderate security risks to accelerate innovation"
• "We will maintain compliance with all applicable regulations"

Risk Tolerance

Definition: The acceptable deviation from risk appetite at the operational level.

Characteristics:

• Business-unit-level decision
• Operational
• Quantitative thresholds
• Triggers action when breached

Examples:

• "A breach of risk appetite by more than 20% requires escalation"
• "Controls must maintain residual risk below 30% of inherent risk"
• "Any risk exceeding threshold requires executive review"

Why Both Are Important

Risk Appetite Without Risk Tolerance:

• No operational guidance
• Unclear when to act
• Decisions inconsistent

Risk Tolerance Without Risk Appetite:

• No strategic direction
• Individual decisions misaligned
• Risk-taking inconsistent

Establishing Risk Appetite and Tolerance

Step 1: Define Risk Appetite

• Board-level discussion
• Align with business strategy
• Document clearly

Step 2: Translate to Risk Tolerance

• Business-unit-level thresholds
• Quantitative where possible
• Document operational guidance

Step 3: Communicate

• Share with all relevant stakeholders
• Train on risk appetite and tolerance
• Integrate into risk decisions

Step 4: Monitor

• Track against thresholds
• Escalate breaches
• Review and update

Risk Acceptance and Risk Appetite

When accepting risks, organizations must ensure :

• The accepted IT risk should be within the risk appetite
• The accepted IT risk should not contradict regulations
• A separate exception should be documented for each unique risk
• Risk acceptance should be renewed periodically
• Risk acceptance should be presented and reported to the risk committee

Conclusion

Risk appetite and tolerance are the foundation of risk decisions. Organizations that define and communicate both will make consistent, aligned risk decisions and avoid surprises.

Action Items for Your Organization

• Document risk appetite
• Define risk tolerance thresholds
• Train stakeholders on both concepts
• Monitor against tolerance thresholds
• Review and update annually