Knowledge Maxxing← Back to topic library
Responsible Tech MaxxingIntermediateRisk Management75 sec
Risk tolerance
Risk tolerance is the level of risk an organization has explicitly decided it's willing to accept for a given system, rather than eliminate entirely.
Prerequisite: Severity
What matters
Because eliminating all risk is rarely possible, defining an explicit tolerance level gives teams a clear line for deciding when a risk needs further mitigation versus when it's acceptable.
Example
An organization might set a risk tolerance that no deployed system may have more than a specific defined rate of a particular type of serious error.
Common misconception
Risk tolerance is not the same as ignoring risk; it's a deliberate, defined threshold, not an absence of concern about risk at all.
Recall question
Why is defining an explicit risk tolerance more useful than aiming to eliminate all risk?
Keywords and related concepts
risk toleranceacceptable riskthresholdrisk register