Risk Appetite: The amount and type of risk an organisation is willing to pursue, accept, or retain in order to achieve its strategic objectives. It is set at a strategic level by the governing body/board and reflects the organisation’s overall “risk-taking” philosophy. It links directly to strategy: how much risk the organisation is prepared to take to create/grow value.
Risk Tolerance: The specific level or variation of risk an organisation is prepared to withstand (i.e., the acceptable deviation from the risk appetite) after risk treatments have been applied. It is more operational and measurable — often expressed through limits, thresholds, key risk indicators (KRIs), or performance metrics. It answers: “How much deviation from our appetite can we actually cope with before it threatens objectives?”
Qualitative RAT in BarnOwl
The following is an example of a RAT framework (qualitative). In BarnOwl, a unique RAT framework can be configured at each business level in the Org structure, allowing RAT to be tailored specifically to each subsidiary, business unit, department, site, or other organisational area. However, in practice a RAT framework is normally only defined at the strategic level. The RAT columns generally map to the Risk Categories.
You will notice that we have a high appetite for ‘Growth, Innovation & Investment’ risks (risks we are prepared /wish to take to achieve growth) and a very low appetite for Health & Safety risks (risks we wish not to take or materialise) and a low appetite for Legal / Regulatory risks (risks we wish not to take or materialise).
BarnOwl plots the risks on a ‘Manhattan’ Risk Appetite heatmap with filtering on RAT (Risk) category and drill down into the detail of each risk
Additional dimensions can be added to this such as:
- Velocity: How quickly the impact materialises. (Immediate, Rapid, Moderate, Slow)
- Persistence: How long the impact lasts. (Temporary, Short-term, Long-term, Permanent)
- Financial Impact
Quantitative RAT in BarnOwl
Where possible, risks should be quantified. In BarnOwl, a unique quantitative RAT framework can be configured at each business level in the Org structure, allowing RAT to be tailored specifically to each subsidiary, business unit, department, site, or other organisational area. The RAT is linked to the risk impact and risk category. For example, your appetite for a Regulatory risk would be far lower than your appetite for a Strategic risk such as ‘growth / investment’:
Eg: quantitative RAT thresholds for ‘Growth & Innovation Strategic’ risks at the ‘ABC Organisation’ level. The amount the organisation is willing to pursue, accept, or retain for a Growth & Innovation risk, ranges from R500K to R2 million.
Eg: Strategic Risk 01 below, with a residual risk value / exposure of R1.5 million (high impact band) equates to an Impact rating of 4. The residual exposure (RE) is R600K (low impact band) based on a residual likelihood (RL) rating of 2.
Eg: quantitative RAT thresholds for ‘Regulatory’ risks at the ‘ABC Organisation\Compliance’ level. Your appetite for a Regulatory risk is far lower than your appetite (risk you are willing to take) for a Strategic risk. The amount the organisation is willing to pursue, accept, or retain for a Regulatory risk, ranges from R10K to R50K.
Eg: Regulatory Risk 001 below with residual risk exposure (e.g. a fine) of R50K (high impact band) has an Impact rating of 5. The residual exposure (RE) is R20K based on the residual likelihood (RI) rating of 2.
In Summary
In summary, this means that the organisation’s maximum appetite for a Strategic risk; a risk it is willing to pursue or accept in support of growth and opportunity is R2 million. In other words, a ‘Growth & Innovation’ strategic risk would only move into the Red appetite band once the potential exposure reaches or exceeds R2 million.
By comparison, the organisation has a far lower appetite for Regulatory risk; a risk it seeks to avoid wherever possible. A Regulatory risk would therefore move into the Red appetite band once the potential exposure reaches R50,000.
A mature Risk Appetite and Tolerance framework, such as that supported by BarnOwl, typically combines:
- Manhattan heat maps and risk visualisation
- Quantitative appetite and tolerance thresholds
- Key Risk Indicators (KRIs) and early warning triggers
- Residual vs inherent risk measurement
- Velocity and persistence scoring
- Strategic objective alignment
- Dynamic dashboard reporting and trend analysis
- Automated escalation and breach notifications
- Business unit-specific appetite models
- Real-time monitoring and integrated reporting
This enables organisations to move beyond static risk registers towards a more proactive, measurable, and executive-focused approach to Enterprise Risk Management.