Risk tolerance
- Term
- Risk tolerance
- Exam
- CISM
- Definition
The acceptable variation around the risk appetite before action or escalation is required.
- Explained
Tolerance is the acceptable variation around appetite, expressed in measurable terms such as hours of downtime or number of unpatched critical systems. Key risk indicator thresholds are usually set at tolerance levels so breaches trigger escalation.
- In practice
Up to two hours of downtime a quarter is tolerated before escalation.
- Often confused with
- Risk appetite
- Exam angle
KRI thresholds are usually set at tolerance levels.
- Related