Glossary term
Risk Tolerance
Subject: Risk Management, Risk Fundamentals and Frameworks
Risk tolerance is how far results may drift from a target for one objective or measure before management must act. It is narrower and easier to measure than risk appetite.
Explanation
Appetite is the broad position; tolerance puts numbers on how far results may drift from target. If a bank targets a capital ratio of 14%, tolerance might allow a fall to 13% before action, with escalation if it dips further. Tolerance is set per objective or metric, such as system downtime, error rates, credit loss ratios or project delay. Breaching it triggers a response: a report to senior management, a review of controls, or approval to continue. Language differs between frameworks. Some use “tolerance” for limits and others for the zone around appetite, so check how a firm defines it. In operational resilience, “impact tolerance” means the most disruption to a service the firm can accept. Managers get a number to watch: crossing it triggers a report, a review or an approval, with no debate about whether it is time.
Example
An online retailer targets 99.9% availability of its checkout service. The board sets the tolerance at no more than four hours of downtime in a month. In March a database fault causes three hours of outage, inside tolerance but close to the edge, so the technology head reports to the risk committee. A second outage that month would breach it and trigger a formal review.
Not to be confused with
- Risk Appetite
- Appetite is the overall level of risk the organisation chooses to pursue; tolerance is the measurable room for deviation on a given objective.