Plain definition
Risk tolerance is the permitted range of variation or exposure around an objective before action or escalation is required. It turns a broad risk appetite into usable boundaries: a service may allow a limited delay, a project may allow a defined cost variance, or a compliance process may allow no intentional breach. Tolerances must suit the objective and the consequence of exceeding them.
Tolerance is not a target and it is not permission to ignore a breach. Crossing a threshold should trigger investigation, decision, or escalation under the organisation’s governance. It can be expressed numerically or through clear conditions when a number would create false precision.
Illustrative example
Suppose a company has an appetite for reliable payroll and sets a tolerance that no employee should miss a scheduled pay date without executive escalation. During a migration to a new payroll system, a test identifies that a group of employees may not receive payment on time. The payroll manager does not wait to see whether the error affects everyone; the manager escalates, activates the fallback payment process, and delays the migration.
The threshold has converted a broad commitment to reliable pay into a concrete decision point. Management can later review whether the fallback worked and whether the tolerance or process design needs revision, rather than treating the near miss as ordinary project noise.
Different objectives need different tolerances. A small financial variation may be acceptable in one process, while a safety, legal, or data-protection event may require immediate escalation.
Why it matters
It tells operators when normal monitoring becomes a management or board decision.
It prevents “within appetite” from becoming a vague explanation for accepting deteriorating performance.
Practical consequence
Choose thresholds or conditions that are observable, linked to an objective, and owned by a role that can act when they are crossed.
Define the escalation, containment, and reporting response in advance, and test it with a realistic near-breach scenario.