Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.

Risk decision conceptIntermediate

Risk Appetite and Risk Tolerance

Risk appetite describes the amount and type of risk an organization is willing to pursue or retain, while risk tolerance defines acceptable variation around specific objectives.

What it means

Appetite is broad direction from leadership. Tolerance translates that direction into measurable boundaries for systems, services, projects, or risk categories so owners know when escalation or treatment is required.

Why it matters

Without explicit boundaries, teams make inconsistent decisions and may accept exposure that leadership never intended to carry.

Practical focus

  • Express appetite in business language
  • Define measurable tolerances for important services
  • Link thresholds to escalation and decision rights
  • Review tolerances when objectives or conditions change

Common mistakes

  • Using appetite and tolerance as synonyms
  • Writing statements too vague to guide decisions
  • Setting thresholds without data or ownership
  • Leaving old tolerances in place after major change

Certification relevance

This subject appears in or supports the following certification bodies of knowledge:

ISACA CRISCISACA CISMISC2 CGRC

Authoritative sources