Which statement is true about risk appetite and risk tolerance?

• A. The overall level of risk an organization is willing to accept
• B. The acceptable variation around the risk level set by the organization
• C. The minimum level of risk required for operations
• D. A measure used only by insurers

Answer: (B)

Understanding how risk appetite and risk tolerance relate. Risk appetite is the overall level of risk an organization is willing to take to pursue its objectives. Risk tolerance is the acceptable variation around that level—the amount of deviation from the target risk that is permitted in practice. The statement describing this variation around the organization’s risk level captures how appetite sets the target and tolerance defines the allowable wiggle room, which is why it’s the best answer. The other descriptions either describe appetite in isolation, mischaracterize risk as a minimum level, or imply a use that isn’t accurate for these concepts.