The level of risk that an organisation is prepared to accept before action is deemed necessary to reduce it.