Capacity, appetite, tolerance and limits are four different things, and most frameworks use two of the words for all four ideas. What each one means, which comes first, and why getting the order wrong is what leaves a statement with numbers nobody can defend.
In short
- Four terms, in a fixed order: capacity is what the institution could absorb, appetite is what it chooses to take, tolerance is how far it will let a measure move before acting, and limits are what individual units are permitted to do.
- The order is not a taxonomy preference. Each term is derived from the one before it, so a framework that starts anywhere other than capacity has thresholds with no origin.
- Appetite and tolerance answer different questions. Appetite is a decision about the future taken in calm conditions; tolerance is a decision about how much movement is acceptable before someone must act.
- The most common practical error is treating the limit book as the appetite framework. Limits usually predate the statement, were set for operational reasons, and add up to something nobody has ever compared against capacity.
- The four terms are worth separating because each has a different owner, a different review cycle, and a different response when it is crossed.
On this page
Risk appetite and risk tolerance are used interchangeably in most institutions, and the confusion is not a vocabulary problem. It is the reason appetite statements contain numbers whose origin nobody can explain.
Four terms, not two#
There are four distinct ideas here, and most frameworks have two words for them.
- **Capacity** — the maximum an institution could absorb before breaching a regulatory minimum or losing the ability to fund itself. It is a property of the balance sheet, not a choice, and it changes when capital, liquidity or the risk profile changes.
- **Appetite** — the amount and type of risk the institution chooses to take in pursuit of its strategy. It is a decision, taken by the board, and it sits inside capacity by a deliberate margin.
- **Tolerance** — how far a measure may move away from appetite before someone has to act. It is the operating band around the chosen level, and it exists because positions move for reasons nobody decided.
- **Limits** — what an individual business line, portfolio or desk is permitted to do. Limits are the instruments through which appetite reaches the people who take risk, and they are the only one of the four that anyone breaches in the ordinary course of business.
Why the order matters#
The sequence above is not a taxonomy preference. Each term is derived from the one before it, which is what gives every number in the framework a place it came from.
Capacity is calculated. Appetite is chosen inside it, and the margin between the two is the board’s stated buffer against being wrong. Tolerance is set around appetite, wide enough that ordinary movement does not trigger a meeting and narrow enough that a real drift does. Limits are then cut from appetite and distributed, which is the point at which the sum of the parts has to be reconciled against the whole.
A framework that starts anywhere else has thresholds with no origin. The usual starting point is the existing limit book, because it is already there and already agreed, and the result is an appetite statement reverse-engineered from decisions taken years ago for operational reasons.
Each term is derived from the one before it, and that is what gives every number in the framework somewhere it came from.
Appetite and tolerance answer different questions#
The two terms most often merged are the two that differ most in what they are for.
Appetite answers a forward-looking question asked in calm conditions: given this strategy, how much of this risk do we want to be running a year from now. It is a positioning decision, it belongs to the board, and it is revisited on the strategy cycle.
Tolerance answers an operational question asked continuously: the measure has moved, does anyone have to do something about it yet. It belongs to the executive, it is revisited when volatility or the balance sheet changes, and it is what makes reporting actionable — a measure with an appetite level but no tolerance band produces a report that says the number, and a report that says the number is not a management instrument.
Where it goes wrong#
Three confusions between these terms do real damage, and each has a recognisable symptom.
- **The limit book is treated as the appetite framework.** Limits predate the statement and were set for operational reasons — a desk’s size, a system’s constraint, a historical negotiation. Summed, they describe how much risk the institution has permitted rather than how much it has chosen, and the two have usually never been compared.
- **Tolerance is used as a second, softer appetite.** A measure is given an appetite level and a tolerance level, both reported, neither with a stated consequence, and the practical effect is that breaching the first means nothing because the second exists.
- **Capacity is never calculated at all.** Appetite is set directly against peer practice or last year’s numbers, and the question the framework exists to answer — how much could we absorb if this went badly — is answered nowhere in the document.
The third is the most consequential and the easiest to miss, because a framework can look complete without it. Everything downstream is internally consistent; it is simply anchored to nothing.
What good looks like#
In a framework where the four terms are genuinely separate, each has its own owner, its own review cycle and its own response when crossed.
- Capacity is recalculated when capital, liquidity or the risk profile moves, and it is owned where the capital and liquidity assessment work already sits.
- Appetite is revisited on the strategy cycle and owned by the board, with the margin to capacity stated rather than implied.
- Tolerance is reviewed when volatility changes and owned by the executive, and crossing it triggers an action with a named owner and a date.
- Limits are reviewed continuously, owned in the business, and reconciled upward — the sum of what has been distributed is compared against appetite, and the difference is explained.
That upward reconciliation is the test most frameworks have never run, and it is cheap. Add up the limits and compare the total with the appetite they are supposed to express.
What to do next#
Take one material risk type and write the four numbers on a single page: capacity, appetite, tolerance and the sum of the limits distributed. Then ask where each came from and who owns it.
Most institutions find that two of the four have no derivation and one has no owner. That page is a more useful diagnostic than a review of the statement’s wording, and it takes an afternoon to produce for the risk type that matters most.
Frequently asked
What is the difference between risk appetite and risk tolerance?
Risk appetite is the amount and type of risk an institution chooses to take in pursuit of its strategy — a forward-looking positioning decision taken by the board in calm conditions and revisited on the strategy cycle. Risk tolerance is how far a measure may move away from that chosen level before someone has to act — an operating band around appetite, owned by the executive, reviewed when volatility or the balance sheet changes. Appetite answers how much of this risk we want to be running a year from now; tolerance answers whether the movement that has just occurred requires action yet. A measure with an appetite level but no tolerance band produces reporting that states a number without saying what to do about it.
What is risk capacity, and how does it differ from risk appetite?
Risk capacity is the maximum an institution could absorb before breaching a regulatory minimum or losing the ability to fund itself. It is a property of the balance sheet rather than a choice, it is calculated, and it changes when capital, liquidity or the risk profile changes. Risk appetite is the level the institution chooses to run inside that capacity, and the margin between the two is the deliberate buffer the board keeps so that being wrong remains survivable. The distinction matters because appetite thresholds are supposed to be derived from capacity: a framework that never calculates capacity can still be internally consistent, but every number in it is anchored to nothing.
Are risk limits the same as risk appetite?
No, and treating them as the same is the most common practical error in this area. Limits are what an individual business line, portfolio or desk is permitted to do — the instruments through which appetite reaches the people who actually take risk. In most institutions the limit book predates the appetite statement and was set for operational reasons: a desk’s size, a system constraint, a historical negotiation. Summed, limits describe how much risk the institution has permitted rather than how much it has chosen. The cheap test is to add up the limits distributed for one material risk type and compare the total against the appetite they are supposed to express; the two have usually never been reconciled.
In what order should capacity, appetite, tolerance and limits be set?
Capacity first, then appetite, then tolerance, then limits — and the order is structural rather than a matter of preference, because each term is derived from the one before it. Capacity is calculated from the capital and liquidity position. Appetite is chosen inside capacity, with the margin stated. Tolerance is set around appetite, wide enough that ordinary movement does not trigger a meeting and narrow enough that a real drift does. Limits are cut from appetite and distributed, then reconciled upward so the sum of the parts is compared against the whole. Frameworks that start from the existing limit book end up with an appetite statement reverse-engineered from decisions taken years earlier for reasons unrelated to strategy.
The programme behind this article
Work through this material with the practitioners who wrote it.
Practical Risk Appetite and Risk Tolerance Masterclass
Risk appetite as a working management tool — frameworks, metrics and trigger levels that turn a board statement into daily decisions across the organisation.
View the programme →Advanced Enterprise Risk Management (ERM) Masterclass
Enterprise risk management that runs as one discipline across the organisation — framework design, risk appetite, quantitative analysis and the updated COSO ERM model, built for implementation.
View the programme →Basel II and III, ERM, Stress Testing and ICAAP Masterclass
Enterprise risk, stress testing and the ICAAP as one connected system — capital buffers built in good times so stress-period losses never threaten the bank.
View the programme →