Risk appetite is how much risk the organization is willing to pursue. Tolerance is the acceptable variation around it. Risk acceptance is a decision to live with a specific risk. An exception or waiver is the record of that decision for a policy or control. The words overlap, so define them once.
Definitions
| Term | Plain meaning | Example |
|---|---|---|
| Risk appetite | Broad statement of how much risk to take for goals | "We accept low risk to customer data." |
| Risk tolerance | Limits within that appetite, often measurable | "No unmitigated critical findings on internet-facing systems beyond a set period." |
| Risk acceptance | A decision to take no further action on one risk, for now | "We keep this flaw open until the vendor ships a patch." |
| Exception | Approved permission to not meet a policy requirement | "This service may skip the patch deadline." |
| Waiver | Often the same as an exception. Some teams use it for time-limited relief | "Waiver for one release." |
| Deviation | Another word for a recorded departure from a standard | Common in some compliance regimes |
| Compensating control | A substitute safeguard that reduces the risk | "Traffic restricted by a network rule." |
Teams use these words differently. What matters is that your policy defines each one and uses it the same way every time.
How they connect
Appetite and tolerance come first, set by leadership. They create the lines. When a finding crosses a line, you either fix it or ask for an exception. The approver, acting within delegated authority, accepts the residual risk. NIST SP 800-53 RA-7 describes this idea as responding to findings "in accordance with organizational risk tolerance."
So acceptance is the decision, and the exception is the paperwork that makes it traceable.
Where people get confused
- Acceptance vs exception. You accept a risk. You grant an exception to a rule. Many real cases involve both.
- Waiver vs false positive. A waiver covers a real issue you will not fix now. A false positive is not a real issue. See false positive, accepted risk and won't fix statuses.
- Exception vs VEX. A VEX not_affected statement is a factual claim about exploitability, not a permission.
- Appetite vs tolerance. Appetite is the goal. Tolerance is the measurable boundary.
Write it into policy
State each term in one sentence. Define who may accept what, for how long, and where the record lives. Use security decision records for the longer rationale behind big calls.
Where Safeguard fits
Safeguard policies, gates and guardrails turn tolerance into enforced rules, and its compliance evidence automation keeps waivers and approvals on record.
Quick check
Is a waiver the same as risk acceptance?
Not exactly. Acceptance is the decision to live with a risk. A waiver is a record that relaxes a requirement. A waiver normally rests on an acceptance.
Who sets risk tolerance?
Senior leadership, often with input from security and risk. Approvers then act inside those limits.
Sources
Last reviewed: 19 October 2026.
