Explain the difference between risk appetite and risk tolerance in a TPRM context.

• A. Appetite is the overall willingness to accept risk; tolerance defines acceptable deviations from risk thresholds for specific risks.
• B. Appetite is the specific risk tolerance; tolerance is the general willingness to take risk.
• C. Appetite is the maximum risk a vendor can take; tolerance is the minimum risk kept.
• D. Appetite and tolerance are identical concepts.

Answer: (A)

In risk management, the idea is to separate how much risk you’re generally willing to take from how much variation you’ll tolerate in specific risk areas. Risk appetite is the broad, strategic willingness to accept risk in pursuit of objectives, including risks coming from third parties. It sets the overall tone for how aggressive or conservative the organization is about taking on risk in its vendor landscape.

Risk tolerance translates that stance into concrete, actionable limits for particular risks. It defines acceptable deviations from risk thresholds for specific categories, along with the triggers or actions if those thresholds are exceeded. In a TPRM program, you might have a moderate overall appetite for using third parties to enable growth, but you’d mandate low tolerance for cyber risk in vendors, with strict thresholds and rapid remediation requirements.

That combination—appetite as the general willingness to accept risk, and tolerance as the defined acceptable variance around risk thresholds for individual risks—best captures the relationship between the two. The other descriptions swap, misstate, or equate these concepts, which doesn’t align with how risk posture is managed in practice.