Risk appetite is the broad amount and type of risk an organisation is willing to take in pursuit of its objectives. Risk tolerance is the measurable boundary around that: how far results can vary, or how much of a specific risk can be carried, before action is required. Put simply, appetite is the board's statement of intent; tolerances are the limits managers can check against every month. Frameworks word these definitions slightly differently, so agree your own definitions and use them consistently.
Define each term carefully
Risk appetite is set by the board or leadership. It is usually expressed in words, by risk category, for example "low", "moderate" or "high" appetite, with a sentence explaining why. It answers: how much risk do we want to take to achieve our strategy?
Risk tolerance turns appetite into numbers or clear thresholds. It answers: at what point does the risk we are carrying need attention? Tolerances are set by management within the appetite and can be monitored.
Some organisations also use risk capacity: the maximum risk the organisation could bear before it fails or breaches its obligations. Appetite should sit comfortably inside capacity.
How the main references use the terms:
- The COSO ERM framework describes appetite as the types and amount of risk an organisation is willing to accept in pursuit of value, and tolerance as the acceptable variation in performance around specific objectives.
- ISO 31000 and its vocabulary describe appetite as the amount and type of risk an organisation is willing to pursue or retain.
Differences in wording matter less than consistency inside your organisation.
A worked scenario: one company, one set of risks
Harbour Foods is a fictional food manufacturer growing into export markets. Its board sets the following appetite statements:
| Category | Appetite | Statement |
|---|---|---|
| Food safety | Very low | We will not compromise food safety to achieve growth or cost targets |
| Commercial expansion | Moderate | We accept measured risk to enter two new export markets over three years |
| Liquidity | Low | We will always be able to meet our obligations as they fall due |
Connect strategic appetite to operating limits
Management then sets tolerances that make each statement measurable:
| Category | Tolerance (operating limit) | Measured |
|---|---|---|
| Food safety | Zero product recalls; no more than 2 minor audit findings per site per year | Per audit, monthly report |
| Commercial expansion | Losses in any new market no greater than £400,000 a year; exit review if revenue is below 50% of plan after 18 months | Quarterly |
| Liquidity | Cash headroom never below £1.5 million; forecast headroom reviewed weekly | Weekly |
Notice how the tolerances reflect the appetite. Very low appetite leads to tight or zero tolerances; moderate appetite allows a defined loss in pursuit of growth.
Explain escalation
Tolerances only matter if something happens when they are approached or breached. Harbour Foods uses three zones:
- Green: within tolerance. Managed by the risk owner.
- Amber: approaching the limit, for example cash headroom below £2 million. The risk owner reports to the executive team with a recovery plan.
- Red: limit breached. Reported to the board at once, with options: act to bring the risk back within tolerance, or ask the board to consciously accept it temporarily.
Write the escalation route down, including who must be told and how quickly.
Writing a risk appetite statement
- Start from strategy: which risks must you take to achieve it, and which must you avoid?
- Group risks into a small number of categories.
- For each, state the appetite level and one sentence of reasoning.
- Agree measurable tolerances with management.
- Review the statement at least once a year and when strategy changes.
Avoid statements so general that any decision could be justified, such as "we have a balanced appetite for risk".
Related reading
- Enterprise risk management subject guide: frameworks, registers, appetite, assessment and the course
- Risk register practice pack: a worked register entry with defined scales
- How to build an enterprise risk management framework
- Risk register example: fields, ownership and review
Setting appetite and tolerances is part of our enterprise risk management course content, which covers frameworks aligned with ISO 31000 and COSO ERM.
The bottom line
Appetite is the direction; tolerance is the guard rail. Write appetite in words the board can own, turn it into limits managers can measure, and agree in advance what happens when a limit is reached.