Explain risk appetite versus risk tolerance.

Risk appetite is the board-level, mostly qualitative statement of how much and what types of risk the organization is willing to take in pursuit of its strategy — the high-level 'how far we'll go'. Risk tolerance (often expressed as risk limits) translates that appetite into specific, quantified operational boundaries per risk category — e.g., NPL ratio ≤ 3%, a VaR limit, a single-name concentration cap, a minimum liquidity buffer. So appetite is strategic and directional; tolerance/limits are the measurable thresholds that operationalize it and that the first line actually manages against, with breaches escalated. The chain runs appetite → tolerance/limits → monitoring/KRIs → escalation. The common confusion is conflating the two: a risk appetite statement without quantified limits is unactionable, and limits without a clear appetite are arbitrary. Both must link back to strategy and be reviewed as conditions change.