The city council states it is willing to take moderate cyber risk to keep online permitting fast for businesses, while IT must keep residual risk inside a defined band around that stance. How should appetite and tolerance be distinguished here?
Select an answer to reveal the explanation.
Short Explanation
Appetite is the destination the council picks on the risk map—how much risk they're okay chasing for speed. Tolerance is the guardrails around that destination so IT doesn't drift into reckless or overly timid territory.
Full Explanation
Risk appetite expresses how much and what type of risk leadership is willing to pursue or retain to meet objectives. In this municipal case, the city council's willingness to accept moderate cyber risk to keep online permitting fast is appetite: a desired operating stance set by governance. Risk tolerance defines the acceptable variance or band around that appetite that operating teams must stay within. IT's duty to keep residual risk inside a defined band is tolerance enforcement, not a separate brand preference or vendor rule. Treating appetite as firewall brand preference and tolerance as the patch Tuesday schedule confuses technology choices and maintenance calendars with governance risk posture. Brands and patch days may support controls but do not define appetite versus tolerance. Calling appetite and tolerance identical terms for the same numeric ALE collapses two related but distinct concepts. ALE is a quantitative loss estimate; appetite and tolerance are governance boundaries that may use many metrics, not a single shared ALE synonym. Claiming tolerance is set only by vendors and appetite only by end users misassigns authority. In public sector practice, elected or executive leadership sets appetite; management defines tolerances within that stance. Vendors and end users do not solely set those governance levels. Exam caveat: Appetite is the target risk level leadership wants; tolerance is how far operations may deviate while remaining acceptable. Questions often pair a strategic willingness statement with an operational band—that pairing is appetite then tolerance. Operational check: Record council-approved appetite for permitting speed versus cyber risk, publish measurable tolerance thresholds for residual risk or KRIs, and require IT escalation when metrics drift outside the band.