Risk appetite

Risk appetite is how much risk an organisation is willing to take on purpose in order to get something it wants. Tolerance is how far it can drift beyond that before somebody has to act.

Most organisations have never written either one down, which is why security arguments go round in circles. Without an agreed answer, every individual decision becomes a fresh debate about whether this particular risk is acceptable, settled by whoever is most senior or most persistent in the room. Deciding once, in advance and in the open, is what turns those arguments into ordinary decisions.