Topics in this domain
- Risk Response Options: Accept, Mitigate, Transfer, Avoid
- Aligning Responses with Appetite and Tolerance
- Cost-Benefit Analysis of Risk Responses
- Bias in Risk Decisions and Reporting
- Risk Owners and Control Owners
- RACI and Escalation
- Third-Party Risk Governance and Due Diligence
- Contracts, SLAs and the Right to Audit
- Monitoring Third Parties and Planning Exit
- Managing Issues, Findings and Control Deviations
- Risk Acceptance, Exceptions and Exemptions
- Control Frameworks and Their Purpose
- Control Types and Functions
- Designing and Selecting Controls
- Implementing Controls and Why Implementations Fail
- Control Design versus Operating Effectiveness
- Control Testing: Objectives, Evidence and Frequency
- Building and Tracking Risk Action Plans
- Collecting and Aggregating Risk Data
- Validating Risk Data Quality
- KRIs, KPIs and KCIs
- Thresholds, Escalation Triggers and Appetite
- Metric Pitfalls and Misuse
- Continuous Monitoring versus Periodic Assessment
- Tailoring Risk Reports to the Audience
- Heat Maps, Dashboards and Scorecards
- Identifying and Assessing Emerging Risks
- Integrating Emerging Risk into Decisions
Thresholds, Escalation Triggers and Appetite
Thresholds inside tolerance
Each level triggers action
Setting thresholds
- Start from the tolerance agreed with the owner.
- Use history to see normal variation.
- Allow lead time to act before the limit is reached.
- Name the response and the recipient for each level.
Example. Tolerance for payment platform outage is 2 hours a quarter. The amber threshold triggers at 60 minutes cumulative, giving operations time to fix underlying issues before the board’s limit is reached.
Don’t move the goalposts
When a KRI turns red, the right reaction is to respond, not to raise the threshold. Thresholds change only when appetite, the business or the risk itself changes, and that change is approved and recorded.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Where to set KRI thresholds | Inside tolerance, with time to act |
| KRI breaches its threshold | Follow the agreed escalation and response |
| Basis for thresholds | Risk appetite and tolerance |
| Owner wants to raise a red threshold | Only if appetite or the risk has changed, with approval |
In short
- Thresholds turn indicators into action: each level triggers a defined response.
- Set thresholds inside tolerance so there's time to act before the limit is breached.
- Thresholds come from risk appetite and tolerance agreed with risk owners.
- Each threshold names who is told and what must happen.
- Review thresholds when appetite, the business or the risk changes, not to make a red indicator green.
Exam traps
- Setting thresholds at the tolerance limit, leaving no time to act.
- Raising a threshold to stop an indicator showing red.
- Thresholds with no defined response or owner.
- One threshold level for every indicator regardless of risk.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Thresholds inside tolerance
Each level triggers action
1 / 8