Define risk appetite and risk tolerance in risk management.

• A. Appetite is the overall level of risk an organization accepts; tolerance is the acceptable deviation for a specific risk.
• B. Appetite is the maximum budget for security.
• C. Tolerance is the amount of time to respond.
• D. Appetite is regulatory requirement.

Answer: (A)

Risk appetite is the broad, strategic level of risk the organization is willing to accept in pursuit of its objectives; it sets the general direction for decision-making and risk-taking. Risk tolerance turns that direction into concrete guardrails by specifying the acceptable deviation from risk targets for particular risks or indicators, with measurable thresholds that trigger action when they’re exceeded.

For example, a company might have a moderate appetite for credit risk in order to pursue growth, but tight tolerance around loan default rates, meaning if delinquencies exceed a defined threshold, interventions must happen. Another way to see it is that appetite guides what kinds of risk are acceptable in general, while tolerance defines the exact limits for specific risks.

The other options don’t fit because they describe resources, response timing, or regulatory requirements rather than the high‑level willingness to take risk and the specific, measurable limits that govern risk management.