The maximum tolerable level of frequency and severity of an operational risk that an organization can bear, after mitigation, management, and transfer. This should be included within the firm’s risk appetite statement. Operational risk tolerances should be expressed in terms of metrics.