Which statement best defines risk tolerance?

• A. The acceptable variance around objectives or KRIs.
• B. The overall appetite for risk across the organization.
• C. The maximum possible loss in any scenario.
• D. The policy that prohibits any risk.

Answer: (A)

Risk tolerance is the level of deviation from objectives or key risk indicators that the organization is willing to accept. It sets the practical boundaries for how much variation around planned outcomes is permissible before actions are triggered or adjustments are made. This is different from risk appetite, which is the broader, strategic willingness to take on risk in pursuit of objectives. It’s also not about the maximum possible loss in every scenario, which would be a risk limit or worst-case exposure, nor about a policy that eliminates all risk, which is zero‑tolerance or risk aversion. So the idea of acceptable variance around objectives or KRIs best captures the concept of risk tolerance.