Risk tolerance is how much risk a stakeholder or organisation will accept on a project objective. In PMP and PMBOK language it sits next to two other terms: risk appetite (the general willingness to take risk for a reward) and risk threshold (the measurable point where a risk becomes unacceptable and you must act). For the exam you need to tell these three apart, know how you find tolerance from stakeholders, and know how it shapes your response choices and the size of your contingency reserve.
✦
From my experience: On my UAE construction projects, two clients could react in opposite ways to the same risk. One would accept a late long-lead material delivery if it saved money. Another had a fixed handover date and would pay almost anything to protect it. Once I knew which client I had, every contingency decision became easier. When I teach this to my PMP students, the mistake I see most is mixing up tolerance and threshold, so I make them say the number out loud: "above this, we act".
This page is my exam-focused view of risk appetite, tolerance and threshold: the three terms PMI likes to mix up in questions. If you want to run risk management on a real project, from identifying risks to keeping a risk register, read my risk management guide instead. This page is for getting these questions right on the exam.
3
Related PMBOK terms: appetite, tolerance, threshold
Plan RMP
Risk tolerance is defined in the Risk Management Plan
4 types
Cost, schedule, scope and quality tolerance dimensions
Exam tested
Appears regularly in PMP scenario questions
Two project managers hear about the same risk: a 30% chance the main supplier delivers 3 weeks late. One escalates to the sponsor straight away and triggers a contingency plan. The other logs it and books a check-in with the supplier in two weeks. Both can be right, for their own projects. The difference is risk tolerance.
Risk tolerance is not a vague feeling. In PMBOK it is something you find out, write down and use for every risk decision. If you get it wrong or leave it undefined, you will either over-react to small risks (wasting money and credibility) or under-react to serious ones.
On this page you will learn what risk tolerance means in PMP, how it differs from appetite and threshold, how to find it from stakeholders, and how it shapes your risk responses, with exam-style examples.
✦
Where this fits in PMBOK 6: You define risk tolerance in the Plan Risk Management process and use it in all seven risk processes. It goes into the Risk Management Plan, next to the probability and impact scales, risk categories, reporting formats and roles. It sets your scoring thresholds, your contingency reserve and which responses are proportionate. For the full risk process, see the full Risk Management guide.
01 · Definitions
Risk Tolerance vs Risk Appetite vs Risk Threshold: The Three PMBOK Terms
Outside formal project management, people use these three words as if they mean the same thing. PMBOK does not, and the PMP exam checks that you know the difference.
From broad attitude to a specific trigger point.
✦ Risk Appetite
Definition: The general degree of uncertainty an entity is willing to take on in anticipation of a reward.
Risk appetite is a high-level stance: the organisation's general attitude to taking risk. A start-up usually has a high risk appetite. A nuclear plant operator has a very low one.
Example: "Our organisation is willing to accept moderate schedule risk to achieve aggressive market entry targets."
✦ Risk Tolerance
Definition: The specific amount of risk exposure a stakeholder or organisation is willing to accept on a particular project or objective.
Tolerance is more specific than appetite. It applies to each project objective (cost, schedule, scope, quality) and to individual stakeholders, not only to the organisation.
Example: "The sponsor will accept up to a 2-week schedule slip but has zero tolerance for scope reduction."
✦ Risk Threshold
Definition: The measurable level of risk exposure above which action must be taken and below which the organisation accepts the risk.
Threshold turns tolerance into a clear trigger you can measure. On the probability-impact matrix, it is the line above which a risk becomes high priority.
Example: "Any risk with a cost impact exceeding £25,000 must be escalated to the sponsor immediately."
✦ How They Connect
Think of them as a hierarchy:
Appetite is the strategic posture: "how much risk do we like?"
Tolerance is the project-level boundary: "how much can we absorb on this objective?"
Threshold is the operational trigger: "at what exact point do we act?"
Appetite → sets → Tolerance → is measured by → Threshold.
✦
PMP exam tip: If a stakeholder says "we cannot go over budget by more than 5%", that is a risk threshold: a number that triggers action. If the question says "the sponsor is comfortable with some schedule risk", that is risk appetite. If it says "the team can absorb up to a 3-week delay on Phase 2", that is risk tolerance for one objective. For more scenario practice, see 200 free PMP practice questions.
02 · Four Dimensions
The Four Dimensions of Risk Tolerance in Project Management
Risk tolerance is not one number. It applies separately to each of the four main project objectives. A sponsor may accept schedule risk but almost no cost risk. A regulator may accept no quality risk but be flexible on dates. A good risk management plan records tolerance for all four.
Dimension
What it means
Low Tolerance Example
High Tolerance Example
How it shapes responses
Cost
Willingness to absorb budget overruns
Fixed-price contract: any overrun comes from PM's budget
Tolerance differs by stakeholder, not just by project. The sponsor, PMO, client and team often have different tolerances for the same objective. A client with a fixed budget may have zero cost tolerance, while your own company may accept a small overrun to keep the client happy. Record each key stakeholder's tolerance in the Risk Management Plan and agree whose tolerance wins when they conflict. Usually it is the sponsor's or client's.
03 · Identification
How to Identify Risk Tolerance: Practical Techniques
People do not describe their own risk tolerance well. Ask a sponsor "how much risk will you take?" and the answer is nearly always "as little as possible". You find the real answer by asking questions that force a choice, and by looking at what they actually did before.
1
Ask trade-off questions, not attitude questions
Instead of "how much risk are you comfortable with?", ask: "If we could guarantee the deadline but it costs £30,000 more, would you approve it?" or "Would you accept a 20% chance of a 3-week delay to save £15,000?" Trade-off questions show real tolerance because people have to choose.
2
Review historical project decisions
How did the organisation react to risks on past projects? Did they spend contingency to protect the schedule, or accept delays to protect the budget? What people did before tells you more than what they say in a meeting.
3
Examine contracts and governance documents
Penalty clauses, SLAs, regulations and governance rules show you thresholds directly. If the contract has a delay penalty for every week late, you already know how much the client cares about the end date.
4
Run a structured tolerance workshop
Show key stakeholders a set of risk scenarios across cost, schedule, scope and quality, and ask them to mark each one "acceptable", "watch it" or "unacceptable". The line between "watch it" and "unacceptable" is the threshold. One short workshop at the start gives you documented tolerance levels you can defend later.
5
Document and validate in the Risk Management Plan
Write the tolerance levels into the Risk Management Plan and confirm them with stakeholders. This gives everyone the same reference, so you can escalate on facts ("this risk is above the £25,000 cost threshold we agreed") instead of opinion ("I think this is serious").
04 · Application
How Risk Tolerance Shapes Every Risk Management Decision
Risk tolerance is not background information. It drives real decisions in every risk process. Here is how.
1. Risk Tolerance Sets Your Probability-Impact Thresholds
The probability-impact matrix is not neutral. Its High, Medium and Low zones are set by tolerance. An organisation with low cost tolerance calls a smaller cost impact "High" than one with high tolerance. The same £20,000 risk can be high priority in one company and medium in another.
How Tolerance Changes Risk Priority: Same Risk, Different Organisations
Risk
Probability
Cost Impact
Low Cost Tolerance Org
High Cost Tolerance Org
Vendor price increase
0.3
£20,000
HIGH: threshold is £15K
MEDIUM: threshold is £50K
2-week schedule slip
0.4
2 weeks
LOW: schedule flexibility exists
HIGH: contractual penalty clause
Scope change request
0.5
+10% scope
MEDIUM: some scope flex
HIGH: fixed-scope contract
Key insight: the risk did not change, the organisation did. That is why you should not copy a risk register from an old project without checking the new stakeholders' tolerance first.
2. Risk Tolerance Determines Your Contingency Reserve Size
The contingency reserve is the money held for known risks. Its size depends on your risk analysis (for example EMV or a Monte Carlo simulation) and on tolerance. A risk-averse organisation may want a reserve that covers most simulated outcomes, while a more risk-tolerant one may accept a lower confidence level. Same risks, different reserve, because tolerance is different.
For the complete guide to EMV calculations and how they feed into contingency reserve, see the Earned Value Management guide.
3. Risk Tolerance Dictates Which Response Strategy Is Proportionate
Low Tolerance
Avoid or Transfer: eliminate the risk or move it off the project
When tolerance for a risk dimension is near zero, acceptance is not viable and mitigation may be insufficient. The only proportionate responses are avoiding the risk entirely (change the plan to eliminate the cause) or transferring the financial consequence to a third party through contract or insurance.
Medium Tolerance
Mitigate: reduce probability or impact to within tolerance
With moderate tolerance, the objective is not elimination but reduction. Mitigation actions target either the cause (reduce probability) or the effect (reduce impact) until the residual risk sits within the documented tolerance band. Contingency reserve covers the residual.
High Tolerance
Accept: acknowledge the risk and proceed
When tolerance is high and the risk sits within bounds, active acceptance (allocating a small contingency reserve) or passive acceptance (dealing with it if it occurs) is the correct response. Spending mitigation budget on a risk within tolerance wastes resources better allocated to higher-priority risks.
05 · Stakeholder Dynamics
How do you manage conflicting risk tolerances?
On most projects, stakeholders have different tolerances and rarely say so. A sponsor focused on strategy may accept schedule risk but not scope cuts. A finance director may accept no cost overrun but not mind the dates. A compliance officer may accept no quality risk but be flexible on the rest.
Handling these conflicts is a real skill, and the PMP exam tests it through stakeholder scenarios. For how to map and engage stakeholders, see the Stakeholder Management guide.
A Framework for Resolving Tolerance Conflicts
When stakeholder tolerances conflict, the Risk Management Plan needs a documented escalation hierarchy: whose tolerance takes precedence when they differ. In practice:
Contract terms override stakeholder preferences: if the contract sets a deadline penalty, that overrides the sponsor's stated schedule flexibility
Regulatory requirements override commercial tolerances: a statutory quality standard cannot be relaxed by any sponsor regardless of their tolerance
Sponsor tolerance is the default project-level setting: where no contractual or regulatory constraint applies, the sponsor's documented tolerance is the operational threshold
Conflicts between stakeholders should be escalated, not resolved unilaterally: when the client and the sponsor have materially different tolerances, the PM should present the conflict explicitly and get a documented resolution, not make the call independently
✦
Connecting risk tolerance to the books you study: Understanding how cognitive bias distorts perceived risk tolerance is a topic covered in depth in Thinking, Fast and Slow by Daniel Kahneman: one of the recommended reads in our Best Books for Aspiring Project Managers guide. Kahneman's work on loss aversion directly explains why stakeholders consistently understate their real risk tolerance in conversations but reveal it through actual decisions: exactly why trade-off questions work better than direct elicitation.
06 · PMP Exam
Risk Tolerance on the PMP Exam: What You Must Know
Risk tolerance questions come in two forms: definition questions (which term matches this description?) and scenario questions (what should the PM do?). Scenario questions are much more common in the 2026 exam.
The Key Distinctions the Exam Tests
Appetite vs tolerance vs threshold: the exam will describe one and name another; you need to identify the mismatch
Tolerance is stakeholder-specific: an answer that applies the same tolerance to all stakeholders is likely wrong
Tolerance is documented in the Risk Management Plan: not the risk register, not the project charter
Low tolerance requires more active response strategies: an answer suggesting "accept" as the response for a risk that exceeds documented tolerance is wrong
Tolerance shapes contingency reserve size: a lower tolerance means a higher contingency reserve for the same risk profile
Common PMP Exam Scenario Pattern
A typical scenario: "The project sponsor has stated that any cost overrun exceeding 10% is unacceptable. The PM identifies a risk with a 35% probability of causing a 12% budget overrun. What should the PM do first?"
The best answer is to treat this as a risk above the agreed threshold: analyse it, plan a response that brings the exposure back within 10% (often avoid or transfer, or strong mitigation), and make sure the sponsor knows because their stated threshold is at stake. Simply logging it as medium priority is wrong. The sponsor stated a clear threshold, and a 12% impact is above it, whatever the probability.
Quick practice: appetite, tolerance or threshold?
Try these before you read the answers. I use questions like these with my PMP students.
"Our company is happy to take some risk to win new markets." Appetite: a general attitude.
"The client can live with up to two weeks' delay on the fit-out phase." Tolerance: a limit on one objective.
"Any risk that could add more than 5% to the cost goes to the sponsor." Threshold: a number that triggers action.
"Safety risks on site are never accepted." Tolerance of zero for one objective, which then sets the threshold.
Simple test: if you can draw a line and say "above this, we act", it is a threshold. If it describes how much one objective can absorb, it is tolerance. If it describes the organisation's general attitude, it is appetite.
✦
PMP exam context: In PMBOK 6 these ideas belong to the Risk Management knowledge area. In PMBOK 7 they sat in the Uncertainty performance domain. The 2026 exam is built on the 2026 Exam Content Outline and PMBOK 8, and risk questions can appear in the People, Process and Business Environment domains. For practice, work through the 200 free PMP practice questions and filter for risk scenarios, together with the free PMP Study Guide.
07 · Best Practices
Best Practices for Managing Risk Tolerance on Real Projects
1
Define tolerance in the Risk Management Plan: before risks are identified
Set your thresholds before qualitative analysis starts, not after. If you identify risks first and then set thresholds, it is tempting to set them so your risks look manageable. Define tolerance early, in initiation or planning, so it reflects what stakeholders really expect.
2
Make tolerance quantitative, not qualitative
"The sponsor has low cost tolerance" is not something you can act on. "The sponsor's cost threshold is £25,000: any risk with an expected cost impact above this is escalated straight away" is. Turn every tolerance statement into a number for each objective before you sign off the Risk Management Plan.
3
Re-assess tolerance at each phase gate
Tolerance changes during the project. A sponsor who was relaxed about the schedule in Phase 1 may have no tolerance left in Phase 3 as the deadline gets close. An organisation that took financial risk last year may be cautious after a bad audit. Review tolerance at each phase gate or major milestone and update the Risk Management Plan.
4
Use tolerance as an objective escalation trigger
Documented tolerance takes the personal element out of escalation. Instead of "I think this risk is serious", which people can argue with, you say "this risk's expected cost impact of £28,000 is above the agreed threshold of £25,000, so the plan says it goes to the sponsor." The threshold does the escalating. You are just following the plan.
5
Align your contingency reserve to tolerance, not just EMV
EMV gives you the expected cost of your risks. Tolerance tells you how confident your reserve needs to be. A low-tolerance organisation will want a reserve that covers a high share of simulated outcomes. A high-tolerance one may accept a lower confidence level. Make the link between reserve size and tolerance explicit.
Build Your Full Risk Management Capability
Risk tolerance is one part of the full risk process. The full guide covers identification, qualitative and quantitative analysis, all the response strategies for threats and opportunities, and the risk register, with a free template.
In PMP and PMBOK, risk tolerance is the amount of risk a stakeholder or organisation will accept on a particular project objective. It is more specific than risk appetite (the general attitude to risk) and is measured using risk thresholds (the points where risk becomes unacceptable). You record it in the Risk Management Plan during Plan Risk Management, and it affects which risks you prioritise, which responses are proportionate and how big the contingency reserve needs to be.
Risk appetite is the organisation's general willingness to take risk in exchange for a reward. It is set at company or programme level. Risk tolerance is narrower: how much risk a stakeholder will accept on one objective (cost, schedule, scope or quality). An organisation can have a moderate appetite while a sponsor has zero tolerance for schedule slip because of a penalty clause. The exam often tests this difference in scenarios.
In the Risk Management Plan, the output of Plan Risk Management. The plan holds the probability and impact scales, risk categories, reporting formats, risk thresholds, roles and stakeholder risk tolerances. It is not the risk register (individual risks) or the project charter (high-level constraints). If the exam asks where tolerance and thresholds are formally recorded, the answer is the Risk Management Plan.
Tolerance decides how much reserve you hold above the expected value. EMV or a simulation tells you the expected cost of your risks. How much extra you keep depends on how much the organisation fears running out. A low-tolerance organisation wants a reserve that covers most outcomes. A high-tolerance one accepts a smaller buffer. Same data, different reserve. That is why reserve decisions need stakeholder input, not just numbers.
Yes. Tolerance often changes and you should check it at key milestones. Near the delivery date, schedule tolerance usually drops. After a cost overrun, cost tolerance drops. A new leader or a change in the market can shift the whole organisation's appetite. Review stakeholder tolerance at each phase gate and update the Risk Management Plan. Treating tolerance as fixed from day one is a common mistake on long projects.
Agree a hierarchy in the Risk Management Plan. Contract and regulatory limits come first. The sponsor's tolerance is the default where no contract or regulation applies. When stakeholders of equal standing disagree, raise it and get a documented decision rather than deciding alone. Record each key stakeholder's tolerance separately and agree in advance whose tolerance wins. The Stakeholder Management guide on this site covers how to handle conflicting expectations.
Start with the concepts: the risk sections of the PMBOK Guide and a good PMP prep book with worked examples. Then practise lots of risk scenario questions, because the exam tests how you apply the ideas, not whether you can recite definitions. For a reading list, see the Best Books for Aspiring Project Managers guide. For scenario practice, the 200 free PMP practice questions on this site include many risk questions.
