Which statement correctly defines risk tolerance?

Which statement correctly defines risk tolerance?

• A. The degree of formality in governance processes
• B. The regulators' expectations for cyber incident reporting
• C. The amount of risk, on a broad level, an entity is willing to accept in pursuit of value
• D. The acceptable level of variation relative to achievement of a specific objective, and often is best measured in the same units as those used to measure the related objective; tactical and operational in nature

Answer: (D)

Risk tolerance is the acceptable level of variation around the achievement of a specific objective. It expresses how far the organization is willing to stray from that objective and is usually measured in the same units used to measure the objective, making it practical to monitor and manage day-to-day. This makes it more tactical and actionable than the broader concept of risk appetite, which describes how much risk the organization is willing to pursue in pursuit of value. For example, if a revenue objective is $1 million in a quarter, the risk tolerance might be +/- $100,000, indicating the tolerated range of performance around that target. In contrast, the degree of formality in governance processes relates to governance structure, regulator expectations pertain to compliance, and risk appetite describes overall willingness to take risk rather than acceptable variation around a specific objective.

Risk tolerance is the acceptable level of variation around the achievement of a specific objective. It expresses how far the organization is willing to stray from that objective and is usually measured in the same units used to measure the objective, making it practical to monitor and manage day-to-day. This makes it more tactical and actionable than the broader concept of risk appetite, which describes how much risk the organization is willing to pursue in pursuit of value. For example, if a revenue objective is $1 million in a quarter, the risk tolerance might be +/- $100,000, indicating the tolerated range of performance around that target. In contrast, the degree of formality in governance processes relates to governance structure, regulator expectations pertain to compliance, and risk appetite describes overall willingness to take risk rather than acceptable variation around a specific objective.