Which of the following statements best describes the difference between risk appetite and risk tolerance?

Risk appetite is a high-level statement that describes the broad amount and type of risk an organization is willing to accept in pursuit of its strategic objectives. It provides overall guidance. Risk tolerance, in contrast, is the specific and measurable level of deviation from the risk appetite that is acceptable for a particular objective or risk category. It operationalizes the broader appetite by setting practical boundaries. Therefore, risk appetite is the general level of acceptance, and risk tolerance is a more specific concept that is subordinate to and aligned with the overall risk appetite.

A. This statement incorrectly reverses the definitions. Risk appetite is the general attitude, while risk tolerance applies to specific objectives or risks.
B. Risk tolerance is a threshold for acceptable risk-taking, not a risk management approach (which would be to accept, avoid, mitigate, or transfer risk).
D. This is incorrect. In formal risk management frameworks like COSO and ISO 31000, which are central to the IIA's guidance, the two terms have distinct and important meanings.

1. COSO. (2017). Enterprise Risk Management—Integrating with Strategy and Performance.

Reference: Page 95 (Appendix A: Definitions).

Quote/Concept: Defines Risk Appetite as "The types and amount of risk, on a broad level, an organization is willing to accept in pursuit of value." It defines Risk Tolerance as "The acceptable variation in performance relative to the achievement of objectives." This establishes appetite as broad and tolerance as a specific variation, supporting that tolerance is a more specific, subordinate concept.

2. The Institute of Internal Auditors (IIA). (2020). GTAG: Auditing Insider Threat Programs.

Reference: Page 10, Section "Risk Appetite and Tolerance".

Quote/Concept: "Risk appetite is the amount of risk an organization is willing to accept on a broad level... Risk tolerance is the acceptable level of variation an organization is willing to accept regarding the pursuit of its objectives." This source clearly distinguishes the broad nature of appetite from the specific, variational nature of tolerance.

3. Rittenberg, L., & Martens, F. (2012). Enterprise Risk Management: Understanding and Communicating Risk Appetite. COSO.

Reference: Page 6.

Quote/Concept: The paper clarifies the relationship: "Risk tolerances are the specific maximum risk that an organization is willing to take regarding each relevant risk... Risk tolerances need to be in alignment with the organization’s risk appetite." This explicitly frames tolerance as a specific measure that operates within the broader appetite.