Risk Appetite Calculator
Turn a risk appetite statement into numbers: appetite and tolerance thresholds, current utilisation, headroom and worst-case survivability.
Inputs
Appetite Utilisation
82.5%
Appetite Threshold
$2,000,000
Tolerance Threshold
$2,500,000
Headroom Remaining
$350,000
Reduction Needed to Return Inside Appetite
$0
Worst Case as a Share of Capacity
36.0%
Appetite Zone
Within appetite — monitor and report
Worst-Case Survivability
A single worst-case loss is absorbable without threatening the business
Action
Exposure is inside appetite; 5 individual risk(s) above the line still need named owners
Step by step
Values used
Risk capacity — capital available to absorb loss = 25,000,000 $; Risk appetite as a share of capacity = 8 %; Tolerance band above appetite = 25 %; Current aggregate annualised loss expectancy = 1,650,000 $; Single worst-case loss scenario = 9,000,000 $; Individual risks currently above the appetite line = 5 risks
Risk Appetite
Appetite threshold = risk capacity × appetite %; tolerance threshold = appetite × (1 + tolerance %); utilisation = aggregate ALE ÷ appetite threshold.
Appetite Utilisation
= 82.5
Appetite Threshold
= 2,000,000
Tolerance Threshold
= 2,500,000
Headroom Remaining
= 350,000
Reduction Needed to Return Inside Appetite
= 0
Worst Case as a Share of Capacity
= 36.0
How it works
Capacity, appetite and tolerance are three different things and get confused constantly: capacity is what you could survive, appetite is what you have chosen to accept, and tolerance is the band above appetite where you escalate instead of panicking. Utilisation compares aggregate annualised loss expectancy with the appetite threshold, while the worst-case figure is checked against capacity separately, because a portfolio inside appetite can still contain one scenario that ends the company. An appetite statement written in adjectives cannot be breached, which is why nothing happens when it is. Quantifying it makes escalation automatic. The output is a management estimate built on your own ALE inputs, not an actuarial figure.
Formula
Risk Appetite
Appetite threshold = risk capacity × appetite %; tolerance threshold = appetite × (1 + tolerance %); utilisation = aggregate ALE ÷ appetite threshold.
- capacity
- The loss the balance sheet can absorb without existential damage
- appetite
- The share of capacity you choose to put at risk
- tolerance
- The band above appetite that triggers escalation rather than a breach
Frequently Asked Questions
How is Risk Appetite calculated?
Appetite threshold = risk capacity × appetite %; tolerance threshold = appetite × (1 + tolerance %); utilisation = aggregate ALE ÷ appetite threshold. Capacity, appetite and tolerance are three different things and get confused constantly: capacity is what you could survive, appetite is what you have chosen to accept, and tolerance is the band above appetite where you escalate instead of panicking. Utilisation compares aggregate annualised loss expectancy with the appetite threshold, while the worst-case figure is checked against capacity separately, because a portfolio inside appetite can still contain one scenario that ends the company.
Why does Risk Appetite matter?
An appetite statement written in adjectives cannot be breached, which is why nothing happens when it is. Quantifying it makes escalation automatic. The output is a management estimate built on your own ALE inputs, not an actuarial figure.
What values do I need to enter?
This calculator takes 6 inputs: Risk capacity — capital available to absorb loss, Risk appetite as a share of capacity, Tolerance band above appetite, Current aggregate annualised loss expectancy, Single worst-case loss scenario, Individual risks currently above the appetite line. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What is the difference between appetite and tolerance?
Appetite is the level of risk you are willing to take in pursuit of objectives. Tolerance is the deviation from appetite you will accept before acting — the band where a risk owner escalates rather than the point at which a governance failure has occurred. Setting tolerance at zero makes every fluctuation a breach and trains people to ignore breaches.
Why check the worst case against capacity separately?
Because an average hides tail risk. A portfolio comfortably inside appetite can hold one scenario that exceeds everything you could absorb, and that scenario is a board and insurance conversation regardless of how low its likelihood looks.
You might also need
- Residual Risk CalculatorCommonly used together
- Security Investment ROI CalculatorCommonly used together
- Enterprise Risk Score CalculatorCommonly used together
- Risk Register CalculatorCommonly used together
- Business Impact Analysis CalculatorCommonly used together
- Inherent Risk CalculatorAlso in Compliance & GRC