Which of the following statements best describes the difference between risk appetite and risk tolerance?

Question breakdown

Tests

Differentiate risk appetite from risk tolerance

Difficulty

Easy

Key idea: Risk appetite is the broad amount of risk an organization accepts in pursuing value; risk tolerance is the narrower, acceptable variation around specific objectives within that appetite.

How to reach the answer

1. Recall that appetite is set at the entity level by the board and senior management.
2. Tolerance applies appetite to specific objectives or performance measures as acceptable variation.
3. Tolerance therefore sits beneath appetite and is more specific.
4. Option A reverses the two terms, B mislabels tolerance as an approach, and D denies a real distinction.

Each option

• AIncorrect. It swaps the definitions; appetite is the general attitude and tolerance is the objective-specific measure.
• BIncorrect. Appetite is not objective-specific, and tolerance is a measure of acceptable variation, not a risk management approach.
• CCorrect. Appetite is the overall level of risk acceptance, and tolerance is the more specific concept that operates within it.
• DIncorrect. The frameworks clearly treat the two as distinct, related concepts.

Common trap: Option A uses the right vocabulary in reverse order, so readers who skim may pick it.

In practice: Boards approve an appetite statement, and business units then set tolerances such as acceptable downtime or loss thresholds that auditors test against.

Remember: Appetite is broad and set at the top; tolerance is specific and sits beneath appetite.

Drafted with AI assistance and checked against the answer key.