An effective risk framework must establish boundaries that connect daily operational choices to the firm’s financial capacity. Risk teams use a three-tier boundary model:
[Risk Capacity]  ---> Total financial limit the firm can lose without collapsing
  |- [Risk Tolerance] -> Maximum boundary variation allowed for a single business unit
       |- [Risk Appetite] -> Approved baseline risk the firm chooses to take for growth

Defining the Boundaries
  1. Risk Capacity: The absolute maximum financial loss an organization can absorb before going bankrupt. It is determined by baseline capital reserves, liquid assets, and borrowing capacity.
  2. Risk Tolerance: The maximum acceptable variation a business unit can deviate from its risk appetite target.
  3. Risk Appetite: The broad, board-approved statement defining the amount and type of risk an organization is willing to accept to pursue its strategic objectives. [1, 2, 3]

Â