What is risk tolerance?
Risk tolerance is the amount of deviation an organization will accept for a specific risk, objective or metric before someone has to act. Risk appetite is the broad statement of how much risk leadership is willing to take on; tolerances turn it into concrete limits that operations teams can measure and report against. A payment processor's board might state a low appetite for service disruption. The matching tolerance could be that card authorizations may fail for no more than 30 minutes in any month.
How tolerances are expressed
A useful tolerance is specific, measurable and tied to an owner. Examples:
- Critical patches reach at least 95 percent of workstations within 14 days of release.
- The click rate on simulated phishing stays below 5 percent each quarter.
- No more than 1 percent of privileged accounts lack phishing-resistant MFA at any time.
- Fraud losses on the online channel stay under $50,000 per quarter.
- Backups of tier 1 systems are restore-tested at least monthly, with no more than one missed test per year.
Each tolerance is monitored. When a measure nears its limit, the owner is warned; when it crosses the limit, the issue is escalated to whoever the risk policy names, and a treatment decision follows.
Where tolerance comes from
Tolerances are derived from appetite, not set on their own. Leadership defines the appetite, and risk owners and the risk function propose tolerances for their areas that keep results within it. They are revisited when appetite, strategy or the threats facing the industry change. COSO's enterprise risk management framework describes tolerance as the boundaries of acceptable variation in performance, and NIST's enterprise risk guidance makes a similar split, with appetite set at the top and tolerances defined for specific units and systems.
Terminology varies. Some frameworks, including older NIST publications, use risk tolerance almost as a synonym for appetite, so read a document's own definitions before comparing numbers across them.
Example: from appetite to action
An online retailer's appetite statement says it has a low appetite for disruption to checkout. The e-commerce director owns a tolerance of no more than 30 minutes of checkout downtime per month. In March, a DDoS attack causes 50 minutes of outage. The tolerance is breached, so the director escalates to the risk committee, which approves a stronger DDoS protection service. The appetite never changed; the tolerance made it measurable enough to show that the existing controls weren't keeping the business inside it.
Risk tolerance vs. appetite, residual risk and MTD
- Risk appetite: the strategic statement a tolerance is derived from.
- Residual risk: a measured level of risk after controls. A tolerance is a limit that measured levels are compared with.
- Maximum tolerable downtime: in effect a tolerance for one kind of harm, the longest a business function can be down, set through the business impact analysis.
- Fault tolerance: an unrelated engineering term for a system's ability to keep working when a component fails.
Risk tolerance on the CompTIA Security+ exam
Risk tolerance is part of SY0-801 objective 5.2, alongside risk appetite. The exam's distinction is scope: appetite is a broad statement leadership makes about how much risk to take on, while tolerance is a specific, measurable limit for one risk or metric. A scenario quoting a number, such as a maximum outage per month or a patching deadline, describes a tolerance; a statement that the company has a low appetite for regulatory risk describes appetite. Neither is a measured level of risk, so if a question contrasts risk before and after controls, look for inherent and residual risk instead.