The board has stated that the company will accept only a low level of risk to customer data. A business unit asks how far a specific key risk indicator may deviate from its target before escalation is required. Which concept answers the business unit's question?
Select an answer to reveal the explanation.
Short Explanation
Appetite is the speed limit the board sets; tolerance is how far over it you can drift before someone has to be told. The business unit's asking about the drift, so the answer's tolerance. Don't confuse the big-picture statement with the operational threshold.
Full Explanation
Risk appetite is the broad amount and type of risk the enterprise is willing to accept in pursuit of its objectives, as set by the board, here a low appetite for risk to customer data. Risk tolerance translates that appetite into acceptable levels of variation for specific risks or measures: how far a key risk indicator may move from its target before the deviation must be escalated or acted on. The business unit is asking for exactly that operational threshold, so tolerance is the concept that answers it. Risk appetite has already been stated and is too broad to tell the unit at what value of a particular indicator escalation is needed. Risk capacity is the maximum risk the enterprise can bear before its survival or objectives are threatened; it sits above appetite and is not used for day-to-day escalation thresholds. Residual risk describes the risk remaining after treatment; it is a measured level, not an allowance for variation. Exam caveat: tolerances must be consistent with appetite, so a tolerance that permits the indicator to drift into territory the board would reject is set incorrectly. Operational check: confirm each key risk indicator for customer data has a documented target, tolerance thresholds and the escalation route triggered when a threshold is breached.