Intolerable Harm

Intolerable harm exists as a concept because some consequences cannot be priced and accepted — harm to customers, market integrity or safety that a firm must never cause, whatever the disruption. It shifts the leadership question from "what does downtime cost us?" to "what damage must we never inflict on others?". The dependent decision is investment: capabilities that prevent intolerable harm are funded first, before optimisations of ordinary losses. Regulators, not markets, define the outer edge of this boundary.

In supervised sectors the board formally approves, for each important business service, the point at which disruption becomes intolerable — expressed as impact tolerances. The definitions live in the operational resilience framework and are revisited annually and after severe scenario testing. Example: "the payment service unavailable for more than 8 hours, or more than 100,000 customers unable to access their funds, constitutes intolerable harm" — and every plan is then tested against staying inside that line. The UK FCA regime and the CBUAE operational resilience expectations in the UAE are anchored on exactly this construct.

The typical error is treating intolerable harm as another cell in the risk matrix — averaging it with likelihood until a catastrophic outcome looks tolerable because it is "unlikely". The concept is a hard boundary, not a weighted score. How intolerable harm and impact tolerance reshape classic risk management is examined in module M2 "From enterprise risk management to business resilience" of the ERGP programme.