Which term is defined as the organization's readiness to bear the risk after risk treatments in order to achieve its objectives?

Which term is defined as the organization's readiness to bear the risk after risk treatments in order to achieve its objectives?

• A. Risk tolerance
• B. Risk appetite
• C. Risk acceptance
• D. Risk analysis

Answer: (A)

Residual risk after applying protections represents what the organization is willing to live with in pursuit of its objectives. That readiness to bear the remaining risk is called risk tolerance. It sets concrete limits for how much residual risk is acceptable for different assets, processes, or objectives, guiding whether additional controls are needed. By contrast, risk appetite is the broader, strategic willingness to take on risk, while risk acceptance is the decision to tolerate a risk that has been deemed acceptable within those limits. Risk analysis is the process of identifying and evaluating risks, not the organization's readiness to endure them.

Residual risk after applying protections represents what the organization is willing to live with in pursuit of its objectives. That readiness to bear the remaining risk is called risk tolerance. It sets concrete limits for how much residual risk is acceptable for different assets, processes, or objectives, guiding whether additional controls are needed. By contrast, risk appetite is the broader, strategic willingness to take on risk, while risk acceptance is the decision to tolerate a risk that has been deemed acceptable within those limits. Risk analysis is the process of identifying and evaluating risks, not the organization's readiness to endure them.