Risk Tolerance
Definition
The degree of risk that an organization is willing to withstand in pursuit of its objectives, expressed as specific thresholds or boundaries for different risk categories. Risk tolerance defines the upper boundary of acceptable risk — risks exceeding tolerance levels must be treated, transferred, or avoided. Risk tolerance is more specific than risk appetite and is typically expressed as quantitative criteria.
Context
Risk tolerance criteria define the boundaries on the risk matrix. They determine which risk rankings require mandatory action versus which can be accepted. In practice, an organization may tolerate a risk score up to a defined threshold for certain equipment categories but require zero tolerance for safety-critical items.
Examples
- An organization sets risk tolerance at Category C (medium) for non-safety-critical equipment, meaning any item ranked D or E must have an active mitigation plan.
- Safety-critical equipment has zero risk tolerance for Category D or E — any item reaching these levels triggers immediate action and cannot be deferred.
Applicable Standards
- ISO 31000:2018
- COSO ERM
Related Terms
A formal, documented decision to accept a specific risk without further treatment, based on a determination that the risk level is within the organization's risk tolerance criteria or that further risk reduction is not reasonably practicable (ALARP). Risk acceptance requires explicit authorization from a designated decision-maker, documented rationale, a defined review period, and specified conditions or limitations.
Risk AppetiteThe amount and type of risk that an organization is prepared to seek, accept, or tolerate in pursuit of its long-term objectives. Risk appetite is a strategic, board-level statement that sets the overall tone for risk-taking across the organization. It is broader and more directional than risk tolerance, which provides specific measurable thresholds.
Risk MatrixA two-dimensional grid that combines Probability of Failure (PoF) on one axis and Consequence of Failure (CoF) on the other to produce a visual risk ranking. The matrix divides risk into categories (typically A through E or Low/Medium/High/Very High/Extreme) that determine inspection priority, interval, and strategy. Risk matrices provide a standardized framework for comparing and prioritizing risks across diverse equipment populations.
ALARP(ALARP)As Low As Reasonably Practicable — a principle requiring that residual risk be reduced to the lowest level that is reasonably achievable, balancing the cost and effort of further reduction against the benefit gained. The burden of proof lies on the duty holder to demonstrate that further risk reduction is grossly disproportionate to the benefit.
Where this appears in Reliatic
This concept is used in the FMEA & Risk module.