Which of the following statements best describes the difference between risk appetite and risk tolerance?

Definition of Risk Appetite: Risk appetite is the amount and type of risk an organization is willing to

pursue or retain to achieve its objectives. It reflects the organization’s overall approach to risk-taking

and is typically articulated at the highest level of the organization.

Reference: COSO’s Enterprise Risk Management Framework.

Definition of Risk Tolerance: Risk tolerance refers to the acceptable variation relative to the

achievement of specific objectives. It is more granular and specific than risk appetite, detailing the

levels of risk that are acceptable within the parameters set by the organization’s risk appetite.

Reference: IIA’s Practice Guide on Risk Management.

Distinguishing the Two Concepts: Risk appetite is broad and sets the overall boundaries for risk-

taking, while risk tolerance is more specific, outlining acceptable risk levels for particular objectives

within the broader risk appetite framework.

Practical Example: An organization may have a high risk appetite, accepting significant risks to

achieve growth, but its risk tolerance for operational risks (such as system failures) may be low,

indicating minimal acceptable deviations from expected performance.

Conclusion: The correct answer is C, as risk appetite represents the organization’s general level of

risk acceptance, whereas risk tolerance is more specific and detailed, falling under the broader scope

of risk appetite.