FRM Exam Part II · Risk Governance

Risk Appetite and Risk Tolerance for FRM Part II

Updated 11 October 2026 · Fact-checked

Risk appetite is the amount and type of risk a firm is willing to take to pursue its strategy. Risk tolerance is the acceptable variation around that appetite, set as a boundary. Limits cascade from tolerance to business lines. To solve questions, link each measure to strategy, then check it against its threshold.

Understand Risk Appetite and Risk Tolerance

Every firm takes risk to earn a return. Risk appetite is the aggregate level and types of risk the board is willing to accept to achieve its strategic objectives. It is a top-down statement. It says what risks the firm wants, what it avoids, and how much it will carry.

Risk tolerance is narrower. It is the maximum deviation from the appetite the firm will accept, usually expressed as a boundary on a specific metric. Appetite might say: low appetite for operational losses. Tolerance turns that into a number, such as annual operational losses not above a set share of budgeted income. Some firms use the terms loosely. In exam questions, treat appetite as the broad target level and tolerance as the boundary around it.

Risk limits sit below tolerance. They are the operational controls given to business lines, desks, legal entities or processes. A limit should be tighter than the tolerance so management gets a warning before the tolerance is breached. This is the cascade: strategy, then appetite, then tolerance, then limits and triggers, then day-to-day decisions.

A risk appetite statement (RAS) documents all this. A good RAS includes qualitative statements (for example, zero tolerance for regulatory breaches or fraud by staff) and quantitative measures (loss budgets, key risk indicators, capital and liquidity floors). It is approved by the board, drafted with senior management and the chief risk officer, and linked to strategy, capital planning and compensation.

For operational risk, many losses cannot be fully priced or diversified, so qualitative statements matter. Firms often set low appetite for conduct, cyber and compliance failures, and use KRIs with amber and red triggers, loss thresholds and control-effectiveness measures. Governance requires monitoring, escalation of breaches, regular review and challenge from the second line. The board owns the appetite. Business lines own the risks they take within it.

Key formulas to remember

Cascade order: Strategy → Risk appetite → Risk tolerance → Risk limits and triggers → Business decisions; Each level is more granular. Limits must be consistent with, and usually tighter than, tolerance.
Limit headroom: Headroom = Limit − Current exposure (or metric); Negative headroom means a breach that must be escalated. Compare it with the tolerance boundary as well.
Utilisation: Utilisation (%) = Current exposure ÷ Limit × 100; Used for early warning. Amber and red triggers are often set at set percentages of the limit.
Risk capacity vs appetite: Risk appetite ≤ Risk tolerance boundary ≤ Risk capacity; Risk capacity is the maximum risk the firm can bear before breaching capital, liquidity or regulatory constraints. Appetite must sit inside it.

How to solve Risk Appetite and Risk Tolerance questions

Use this method for any question on appetite, tolerance and limits.

1Identify the level being tested: capacity, appetite, tolerance or limit.
2Link the item to strategy and the risk type, such as operational, credit or conduct.
3Decide whether it is qualitative (a statement) or quantitative (a metric with a number).
4Check the ordering: limits should be tighter than tolerance, and tolerance inside capacity.
5Compute utilisation or headroom if numbers are given, and compare with any amber or red trigger.
6Name the governance action: escalate, report to the board or risk committee, remediate, or seek approval for an exception.
7Pick the option that keeps the board as owner of appetite and the second line as independent challenger.

Quickest way: Level and action check

When to use it: Use when time is short and the options mix terms or ask what should happen next.

Ask: broad and board-level (appetite), boundary on a metric (tolerance), or desk-level control (limit)?
Eliminate options where a lower level sets a higher level, such as a desk setting the firm's appetite.
If a metric exceeds its boundary, choose escalation and remediation over quietly resetting the limit.
If numbers are given, do one division: exposure ÷ limit.

Common mistakes in Risk Appetite and Risk Tolerance

Treating risk appetite and risk tolerance as identical
Many firms and texts use the terms interchangeably.
Fix: In exams, appetite is the broad level and types of risk sought. Tolerance is the acceptable variation, expressed as a boundary on a metric.
Thinking a limit and a tolerance are the same number
Both are numeric thresholds.
Fix: Limits are operational and normally tighter than tolerance, giving early warning before the tolerance is breached.
Assuming operational risk appetite must be fully quantitative
Market and credit risk have clear metrics like VaR.
Fix: Operational risk often uses qualitative statements, such as low appetite for fraud or conduct breaches, alongside KRIs and loss thresholds.
Letting business lines own the appetite
Business lines take the risk daily, so they seem responsible.
Fix: The board approves appetite. Management implements it. Business lines operate within limits, and the second line challenges independently.
Confusing risk capacity with risk appetite
Both describe how much risk the firm can take.
Fix: Capacity is the maximum the firm can bear. Appetite is what it chooses to take, and it sits below capacity.
Resolving a breach by raising the limit
It looks like the quickest fix.
Fix: A breach should be escalated, explained and remediated. Limit changes need proper approval and must remain within tolerance.

Worked examples

Example 1

A bank's board sets a tolerance that annual operational losses must not exceed $50 million. Management sets a business-unit limit of $40 million. Year-to-date losses are $34 million. Compute utilisation of the limit and state whether the tolerance is at risk.

Show the solution

Utilisation = 34 ÷ 40 × 100 = 85%.
Headroom to the limit = 40 − 34 = $6 million.
Headroom to the tolerance = 50 − 34 = $16 million.
The limit is tighter than the tolerance, as it should be, so the limit gives early warning.

Answer: Utilisation is 85%, with $6 million of headroom to the limit. The tolerance of $50 million is not breached and has $16 million of headroom, but management should monitor closely and report if an amber trigger is crossed.

Example 2

A risk appetite statement says: "The firm has low appetite for operational risk and will not accept material customer-conduct failures." Which element is this, and what must management add to make it usable?

Show the solution

The statement is broad, board-level and qualitative, so it is a risk appetite statement, not a limit.
It gives direction but no measurable boundary.
Management must translate it into tolerances on metrics, such as maximum annual operational loss and a KRI for conduct complaints.
Then limits and amber/red triggers are set for business lines, and reporting to the board is defined.

Answer: It is a qualitative risk appetite statement. Management must add quantitative tolerances, limits and triggers, cascaded to business lines and monitored with board reporting.

Exam tips

Read the question for the level: appetite, tolerance, limit or capacity. Many wrong options just swap the terms.
If a metric breaches its boundary, the best answer is usually escalation to the right committee or board, not changing the number.
For operational risk, expect qualitative statements plus KRIs and loss thresholds, not VaR-style metrics.
Check that limits are tighter than tolerance and tolerance is within capacity. This eliminates options fast.
Do any arithmetic as exposure ÷ limit and limit − exposure, and compare with the trigger given.

Practice questions from Risk Governance

Risk Appetite and Risk Tolerance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Risk Appetite and Risk Tolerance: frequently asked questions

What is the difference between risk appetite and risk tolerance?

Risk appetite is the overall level and type of risk a firm is willing to take to meet its strategy. Risk tolerance is the acceptable deviation from that, expressed as a boundary on a metric. Some sources blur the terms, so read the context in the question.

What should a risk appetite statement contain?

It should state the types and amount of risk the firm will accept and avoid, with qualitative statements and quantitative measures. It should link to strategy, capital and liquidity planning, and define roles, monitoring and escalation. The board approves it.

How are operational risk appetite limits set?

Start from the board's appetite and strategy. Set tolerances on metrics such as loss budgets, KRIs and control failures, then set tighter limits and triggers for business units. Review them regularly using loss data, scenario analysis and RCSA results.

Who owns risk appetite?

The board owns and approves it. Senior management and the CRO help develop and implement it. Business lines operate within limits, and the second line provides independent challenge and monitoring.