How do you quantify risk tolerance versus risk appetite — and are they the same thing?

Question

AcadiFi · Accepted Answer

Risk appetite is the aggregate amount of risk an organization is willing to take to achieve objectives. Risk tolerance is the specific, operational variation acceptable around that appetite — it operationalizes appetite for day-to-day decisions. If appetite says 'we accept moderate credit risk,' tolerance quantifies that as 'expected credit loss between 0.8% and 1.4% of loan book' with a hard limit at 2%.

For Calderon Capital Bank, the quantification framework includes: (1) Enterprise-level capital-at-risk — maximum acceptable economic capital consumption, e.g., 95% of available capital under stress. (2) Earnings volatility tolerance — standard deviation of quarterly earnings ≤ $40M. (3) Liquidity tolerance — survival horizon ≥ 90 days under stress. (4) Business-unit tolerances — VaR limits, concentration limits, counterparty limits cascading from enterprise targets.

Tolerance is typically expressed as ranges with escalation triggers: target (50% of tolerance used), warning (75%), and limit (100%). Breaches require documented response — remediation plan, reduced exposure, capital injection, or explicit board approval to exceed temporarily. Quantification methods include: VaR, expected shortfall, stress testing, reverse stress testing (what causes failure?), and scenario-based economic capital models. The tolerance framework must reconcile bottom-up limits (desk-level) with top-down appetite (board-level) — if the sum of desk limits exceeds enterprise tolerance, there is implicit over-allocation that must be resolved through limit reductions or capital add-ons.

How do you quantify risk tolerance versus risk appetite — and are they the same thing?

Master Part II with our FRM Course

Related Questions

Practice Questions