In risk assessment, what does risk tolerance refer to?

• A. The minimum risk the facility can accept.
• B. The maximum acceptable level of residual risk after safeguards.
• C. A fixed numerical value unrelated to safeguards.
• D. The risk of noncompliance.

Answer: (B)

Risk tolerance is the maximum level of residual risk the organization is willing to accept after safeguards are applied. In risk assessment, you identify hazards and estimate risk, then implement controls to reduce that risk. The remaining risk—residual risk—must stay within the defined tolerance; if it exceeds it, you add more controls or adjust the design. This concept links safeguards to decision-making, regulatory needs, and consequences, guiding how much risk the organization is prepared to live with. It isn’t about the minimum risk possible, nor is it a fixed value unrelated to safeguards, and it isn’t specifically the risk of noncompliance.