Glossary term
Impact Tolerance
Subject: Risk Management, Business Continuity and Resilience
Impact tolerance is the point beyond which disruption to an important business service, usually measured as time offline, would cause unacceptable harm to customers or to the stability of markets.
Explanation
The idea comes from operational resilience rules, notably in the UK, where firms set a tolerance for each important business service. It assumes disruption will happen, so the question is how bad it can get, not whether it is avoided. The tolerance is normally a time limit, such as a service being unavailable for no more than a set number of hours, and it can include other measures like volume of failed transactions. Firms then map the resources behind the service, test whether they can stay within the limit in severe but plausible scenarios, and fix gaps. Impact tolerance is set by the harm a disruption would cause, mainly to customers and markets, whereas risk appetite reflects what the firm itself is willing to bear. Where a test shows recovery overshooting the limit, the firm must invest or redesign, which is how a tolerance becomes a spending decision.
Example
A mortgage lender decides that if its payment service is down for more than two days, customers risk missing their own bills and suffering real harm. It sets a two-day tolerance. A scenario test simulating loss of its main payment processor shows recovery takes four days. The lender adds a backup processor and repeats the test.
Not to be confused with
- Risk Appetite
- Appetite is the risk a firm chooses to take. Impact tolerance is a limit on disruption to one service, set by the harm it would cause.