Risk Appetite vs Risk Tolerance: What is the Difference?

Taking on risk is an unavoidable part of doing business. While some risks are necessary and can drive positive business outcomes, others can lead to negative impacts such as operating errors, poor strategic decision-making, accidents, potential legal exposure, financial uncertainty, or natural disasters. Most organizations seek proactively to control risk to minimize its potential adverse impacts while harnessing the growth opportunities that embracing the right risks can bring through the process of risk management.

Making this conscious decision about how much risk an organization is willing to take on depends on two key concepts in risk management: risk appetite and risk tolerance. These terms are often used interchangeably and are closely related, but they’re also quite distinct in meaning and utility.

In this article, we’ll explore the differences between these two concepts, and why each is important for effectively managing your organization’s risk.

What is risk appetite?

Risk appetite is the overall level of risk an organization is willing to take on or embrace as it works towards its strategic goals. In short, it’s the overarching threshold we set for our organizations that indicates how far we’re willing to allow risk to progress in pursuit of our objectives before taking action, whether that’s mitigating it, avoiding it altogether, embracing it, or even changing those thresholds.

Most organizations use risk appetite frameworks to guide decision-making around settling on a risk appetite. A risk appetite framework is defined by how the organization views the relationship between risk and reward. An organization with higher risk appetite is essentially willing to accept higher uncertainty and greater volatility in exchange for potentially greater growth or profit. In contrast, an organization with a lower risk appetite is more risk-averse, prioritizing stability and certainty or lower growth over the potential benefits of embracing market or operating volatility.

Risk appetite is typically enshrined in a risk appetite statement.

Although risk appetite is organization-specific, it may also be informed by regulatory or legal requirements. Banks or insurance companies, for instance, must operate within risk parameters defined by regulatory bodies.

To effectively design and apply a risk appetite framework, an organization must adopt agreed-upon risk measurement and risk scoring methodologies, as well as a common risk language, in order to be consistently understood and applied throughout the organization.

Levels of risk appetite

No two organizations will have the same appetite for the same set of risks, and each will require its own analysis to determine what its overall risk appetite might be. Your risk appetite framework can help you decide on the level of risk you’re willing to take on, which you can then articulate in a risk appetite statement.

Here are some common levels of risk appetite:

• Risk-averse: This organization avoids taking risks as much as possible.
• Conservative: This organization accepts some low-impact risks in exchange for slower growth or limited rewards.
• Moderate: This organization minimizes risk-taking where possible, but acknowledges that some risks may be necessary or beneficial to take.
• Open: This organization is more open to taking on higher levels of risk or is willing to consider riskier paths to achieving its goals.
• Aggressive: This organization deliberately embraces the options that it believes will lead to the highest reward, regardless of how risky they might be.

For instance, a hospital system or a company that operates a critical infrastructure facility like a nuclear plant might have a much more conservative or even risk-averse risk appetite, considering their responsibility for patient and public safety, respectively, while a tech startup or venture capital firm might carry higher risk tolerance to attempt to maximize growth or return on investment.

These analyses will also need to be carried out on a regular basis, since risk appetites can change over time.

Importance of establishing your risk appetite

Having a clearly defined risk appetite provides your organization with a guiding light that can help inform every other risk decision you make. The process of establishing your risk appetite can also help you determine whether you’ve been operating under a risk appetite that is too conservative or too aggressive, and whether you should adjust accordingly to maximize your growth while remaining secure and stable.

What is Risk Tolerance?

Once an organization has determined its risk appetite, it must identify the various risks it faces and determine its risk tolerance for each. Risk tolerance represents the specific maximum risk that a company is willing to take on for each type of risk, taking its overall risk appetite into consideration. Much like risk appetite, if the organization’s exposure to this risk crosses the set threshold, action must be taken to address it. Risk tolerance differs in that it affects risk strategy at a much more granular level.

To determine risk tolerance, you must consider the various risks your organization faces, including financial, operational, credit, third-party, information security, compliance, and legal risks, and decide how much of each you are willing to take on. Risk tolerance can be expressed through different metrics that reflect the unique nature of each individual risk, such as acceptable loss, credit ratings, KPI limits, key risk indicators, probabilistic measures, qualitative measures, or balance sheet metrics. These metrics inform daily decision-making and can alert your organization when risk tolerance limits have been or are about to be exceeded. 

For example, a bank with a higher tolerance for credit risk may be willing to lend a higher amount to people or entities with lower credit ratings, taking on relatively more credit risk than a bank with a lower risk tolerance. Or, a manufacturer that depends on a global supply chain may have a higher risk tolerance for foreign exchange risk or operational risk than a manufacturer that sources their inputs domestically. A company may choose to work with third-party vendors to complete specific tasks or functions, trading off assuming some level of third-party risk in exchange for the expertise, value, and flexibility a third party can offer. 

In these examples, the organizations are consciously deciding to take on a level of risk that is within their stated level of tolerance, consistent with their strategic and organizational objectives, and, when all categories of risk are aggregated, within their risk appetite.

Levels of risk tolerance

Risk tolerance levels are similar to risk appetite levels, but differ in that you can have many different risk tolerance levels applied to many different risks, while your risk appetite is a single, overall statement on the level of risk you consider acceptable to your organization.

As such, risk tolerance levels can generally be classified as risk-averse, in which the risk is entirely avoided, or conservative, moderate, or aggressive.

Importance of establishing risk tolerance

Establishing risk tolerances for each of your organizational risks can help you determine whether you are over- or under-managing particular risks, thus increasing your overall risk exposure or wasting resources and missing out on opportunities, respectively.

Setting risk tolerance levels can also help you prioritize risk mitigation and response by allowing you to continuously monitor when a risk is approaching or crossing its predetermined threshold for action, whether that’s the upper limit that requires mitigation or the lower limit, which calls for potentially assuming greater levels of risk for that particular risk.

How do risk appetite and risk tolerance work together?

Risk appetite defines your organization’s approach towards taking risk, including how much of it to take on in pursuit of your goals, while risk tolerance is used to measure how far you’ve allowed each risk to progress in the context of your overall risk appetite.

For example, a large enterprise that handles sensitive data might have a risk appetite statement and risk tolerances levels for their cybersecurity team that looks like this:

Risk appetite: Our organization has a conservative risk appetite toward cybersecurity. We strive to immediately identify and patch vulnerabilities to keep our organization’s data and assets secure, but understand that some vulnerabilities are more severe than others and must be addressed first with our available resources.

Risk tolerance: Zero critical vulnerabilities will be tolerated. These vulnerabilities will be addressed immediately with all available resources. Lower tier vulnerabilities will be assessed for severity and prioritized accordingly.

Conversely, an organization that handles less sensitive data, or an early-stage startup pursuing rapid growth, might take a more aggressive posture towards cybersecurity:

Risk appetite: Our organization has an aggressive risk appetite toward cybersecurity. We strive to immediately identify and patch vulnerabilities to keep our organization’s data and assets secure, but we acknowledge that adopting new technologies can provide us with a significant competitive edge. These technologies may come with increased cybersecurity risk exposure.

Risk tolerance: We'll work our hardest to remain vigilant for cybersecurity vulnerabilities and address them when detected, but we'll consider using any new technology if we think the benefits to our growth strategies outweigh the potential risks.

Together, risk appetite and risk tolerance help shape an organization’s risk posture.

What is risk posture?

Risk posture is a company’s overarching approach to risk management and a function of how embedded risk management is in its culture, strategic decision-making, day-to-day operations, capital allocation, compensation practices, and corporate governance. A strong risk posture helps companies take meaningful risks within the constraints of strategic and operating objectives. 

Establishing a strong risk posture requires senior executive focus and board support to ensure accurate risk reporting, proactive management, and a consistent approach. This needs to be supported by an independent risk function, the use of a risk management platform to identify, analyze, and measure risk, and a conscious, risk-based approach to decision-making.

A well-structured risk appetite framework helps organizations consciously decide how much risk to take in line with overall business and operating strategy. The risk appetite, or acceptable level of trade-off between risk and reward, is captured through an integrated risk management framework with an agreed risk calculation and aggregation methodology, adherence to agreed risk tolerances, and a dynamic risk reporting solution. An organization with a strong risk posture will integrate risk management into its strategic positioning and daily operations, ensuring informed risk-taking is part of its culture.

Using GRC software to determine risk appetites and risk tolerances

Establishing your organization’s risk appetite and risk tolerance levels and managing your risk posture requires a complete view of your entire risk landscape. Modern GRC technology like LogicGate Risk CloudⓇ allows you to centralize all of your risk data in one location, so you easily gauge your current risk exposure and decide how much risk you want to take on, whether you’re taking on too much or too little, and where your tolerance limits for each risk are.

Interested in learning more? Schedule a free demo today.