Organizational Risk Appetite and Tolerance
How much risk the company is willing to take on
Risk appetite is the overall level of risk an organization is willing to take on in pursuit of its business objectives, formally defined by senior management, while risk tolerance sets the specific, measurable limits around that appetite for each risk category, marking the threshold beyond which a deviation is no longer acceptable and requires immediate action. Without this explicit definition, each area of the organization ends up implicitly and inconsistently deciding which risks to tolerate, leading to contradictory decisions in similar situations. In practice, risk appetite must be translated into concrete operational criteria, for example defining that the organization tolerates service outages of up to four hours but no more, so that technical teams have a clear threshold against which to design their controls, instead of a generic statement about minimizing risk that offers no practical guidance for day-to-day decisions.