The city council states it is willing to take moderate cyber risk to keep online permitting fast for businesses, while IT must keep residual risk inside a defined band around that stance. How should appetite and tolerance be distinguished here?
Select an answer to reveal the explanation.
Short Explanation
Appetite is the destination the council picks on the risk map—how much risk they're okay chasing for speed. Tolerance is the guardrails around that destination so IT doesn't drift into reckless or overly timid territory.
Full Explanation
Risk appetite expresses the amount and type of risk leadership is willing to pursue or retain to meet objectives. Risk tolerance defines acceptable deviation from that appetite. In municipal governance, elected or executive bodies often set appetite while operational teams manage within tolerance bands; the terms are related but not interchangeable.