Resilience and Risk Appetite

Risk appetite describes, in broad terms, the kinds and levels of risk a firm is willing to accept in pursuit of its strategy. An impact tolerance is narrower and more concrete: for one important service, it states the level of disruption harm that should not be allowed, so that recovery can be planned and judged against it. The two are related, but they are not interchangeable, and confusing them leaves services without a usable recovery target.

An investment platform illustrates the distinction. Its appetite may accept market and operational risk in general terms, while its tolerance for a dealing service must answer a specific question: if clients cannot deal, which clients suffer what harm, and at what point does that harm become intolerable? Appetite frames the discussion. Tolerance decides the recovery.

Appetite alone is insufficient because it is written for a firm, while disruption is experienced through a service. A firm level statement about operational risk gives a service owner little guidance about which users to prioritise, which recovery step to attempt first, or when to escalate when a service stops. Those decisions need a service level limit expressed in harm terms.

Appetite statements also tend to be written in risk language, such as likelihood and impact in general, while tolerances need to be written in user language, such as who is left without a service and what they lose. Translating between those languages is part of the resilience work, and a firm that skips the translation will find its appetite has no operational consequence during an incident.

The connection should run from appetite to tolerance as a constraint, not as a copy. Appetite sets the broad willingness to bear risk, and tolerances for important services should sit within that willingness, with the most harmful services receiving the tightest tolerances. Where a tolerance would require accepting harm beyond appetite, the inconsistency should be resolved by changing the service, its protection, or the appetite itself, openly rather than silently.

That connection also works in reverse as a challenge. If tolerances across services, taken together, imply a level of risk far above or below the stated appetite, then either the appetite or the tolerances have been misjudged. Reviewing them together, service by service, is a useful board level exercise precisely because it surfaces that tension.

Confusion causes harm when a firm treats a tolerance breach as a mere appetite discussion, to be debated after the fact, rather than as an event that requires escalation and user communication during the disruption. A tolerance is an operational trigger, not a strategic preference, and its breach should change behaviour immediately, not at the next risk committee.

Confusion also causes harm when appetite is used to justify a loose tolerance. A statement that the firm has a high appetite for operational risk does not, by itself, justify leaving vulnerable users without an essential service, because appetite is about the firm risk choices while tolerance is about user harm. The two must be argued separately, even where they are set together.

A firm can keep them distinct by writing them in different places for different purposes: appetite as a firm level statement of risk willingness, tolerances as service level statements of harm limits with reasoning, owners, and test evidence. Alignment is then checked by reading them together and asking whether the service limits, in aggregate, reflect the firm willingness.

Governance should review both, but with different questions. For appetite, the question is whether the firm risk posture still fits its strategy. For tolerances, the question is whether each important service can recover within its limit, and what evidence supports that judgement. Keeping those questions separate prevents either from being answered by the other vocabulary.

For one service, write its tolerance in user harm terms, then place it beside the firm appetite statement and ask whether the two agree, and whether the tolerance alone would tell a service owner what to do during a disruption. If only the appetite statement exists, the service has no recovery target yet.

This guide is educational and does not set appetite or tolerances for any firm. It clarifies a distinction that, when blurred, leaves important services without the concrete limits that recovery planning needs.