Work out risk appetite threshold instantly with clear inputs, formula shown and shareable results.
Risk appetite expressed as a percentage of revenue turns a board statement into a number that can be compared with aggregated residual risk. Tolerance is the buffer above appetite where you are uncomfortable but not yet escalating. Crossing appetite triggers a treatment plan; crossing tolerance triggers escalation, which is what makes the two-threshold structure operationally useful.
Appetite thresholds
appetite = revenue x appetite share; tolerance = appetite x (1 + buffer); utilisation = current aggregate risk / appetite
Usually by summing ALE across the risk register, though that overstates the total when risks are correlated or mutually exclusive. Monte Carlo aggregation is more defensible.
It varies enormously by sector and is a board decision. What matters more than the number is that it is stated, monitored and actually used to stop projects.