If you’ve ever sat in a meeting where someone talked about risk appetite and someone else talked about risk tolerance, and you quietly wondered whether they meant the same thing, you’re in good company. They are two of the most muddled terms in risk management, and I regularly see them used interchangeably in policies and board papers. This week’s news has given us a really clear way to tell them apart.
A story from the Strait of Hormuz
Since the war with Iran began in February, ships crossing the Strait of Hormuz have come under regular attack, and two dozen seafarers have lost their lives. Shipping companies still need oil moved, so they are paying crews a great deal to make the trip. Tanker captains are reportedly earning around $100,000 a month, plus a bonus of $50,000 for every crossing. Shipping executives put the chance of a ship being hit at about one in twenty.
Some crews take the money and go. Others turn it down, even at several times their normal pay. It’s a serious situation rather than a light-hearted example, but between them those two groups show the difference between appetite and tolerance better than any textbook I’ve read.
What is risk appetite?
Risk appetite is the amount and type of risk you’re willing to take on, or hold on to, in order to get something you want. The shipowner sending a tanker through Hormuz has a big appetite for that particular risk, because the rewards are huge. They have weighed it up and decided it’s worth pursuing.
We all do this in everyday life. Booking a cheaper flight with a tight connection is a small piece of risk appetite: you accept a slightly higher chance of missing your onward flight because you’d rather save the money.
What is risk tolerance?
Risk tolerance is about limits. It’s the point beyond which things become unacceptable, however tempting the reward. The sailor who won’t sail through Hormuz at any price is showing you their tolerance. No amount of money moves that line.
Going back to the flight, you might happily take the tight connection for a weekend away. But for your daughter’s wedding you’d book the earlier flight without a second thought, because missing it simply isn’t something you could live with. Same risk, different tolerance.
Why the difference matters
Appetite tells you what you’re prepared to go after; tolerance tells you where to stop. An organisation needs both, and it needs them written in a way people can actually use. A policy that just says “we have a low appetite for risk” doesn’t help anyone make a decision on a busy Tuesday afternoon.
Here’s a simple business example. A small company might be happy to buy all its packaging from one supplier because it’s cheaper and easier, and that’s its appetite. But if it knows it can only manage three days without packaging before orders start being cancelled, that three days is its tolerance. Knowing both tells you whether you need a backup supplier, a bit of spare stock, or nothing at all. Working out those limits is exactly what a business impact analysis is for.
Three questions to ask about your organisation
You don’t need a risk management qualification to start thinking about this. First, ask what your organisation is prepared to take on to achieve its goals, and whether that’s written down anywhere. Second, ask where the line is that you wouldn’t cross, whatever the reward, and whether everyone would agree on where it sits.
The third question is the one people tend to forget: whose risk appetite are you relying on? If your business depends on fuel, deliveries or materials that travel through somewhere like Hormuz, then part of your continuity rests on decisions made by people you’ll never meet. It’s worth knowing which of your suppliers you’d struggle without, and what you’d do if they decided the risk wasn’t worth it any more.
Want to find out more?
If you’d like to read a more in-depth take on the Hormuz story, including what the ISO 22301 standard used to say about risk appetite, there’s a longer article on the Cambridge Risk Solutions blog.
And if you’d like to understand how organisations work out what they can and can’t tolerate during a disruption, our Resilience Foundations Bundle covers business continuity, business impact analysis and crisis management in plain English. Written by consultants, voiced by a professional, and designed for people who aren’t risk specialists.
Related posts:
RiskReady Shortlisted for Specialist Company of the Year at the Business Continuity Awards 2026
What is a Business Impact Analysis — and why does your organisation need one?
What is business continuity — and why should small businesses care?
The Loggist: one of the most important roles nobody trains for