Risk Appetite vs Tolerance vs Capacity

• Risk appetite: how much risk, and what *type*, an organization is *willing* to take on to pursue its objectives. The big-picture stance, set by leadership.
• Risk tolerance: the *acceptable variation* around a specific risk or objective. The practical limits *within* the appetite.
• Risk capacity: the *maximum* risk the organization could absorb before it threatens viability, regardless of what it wants. A hard ceiling.

Picture a fintech:

• Appetite: willing to accept *moderate* cyber risk to ship features fast.
• Tolerance: but *zero* tolerance for any exposure of customer payment data: that variation is unacceptable.
• Capacity: a breach of more than a certain size would breach covenants and end the business: that's the capacity ceiling, well beyond the appetite.

In an interview, the move that scores is: appetite is *willingness*, tolerance is *variation around a specific risk*, capacity is *the absolute limit*: then give one example that runs through all three.