Threshold

A threshold turns a measured indicator into a decision rule: below the line you monitor, above it you act. Executives depend on thresholds because escalation should not rest on personal judgement in the middle of the night. An agreed threshold removes the debate about whether a situation is serious enough to wake the crisis team. In this sense, thresholds are how risk appetite becomes daily practice.

Thresholds are derived from appetite statements and continuity limits such as MAO and impact tolerance. The risk or process owner proposes them, the risk committee approves them, and they are recorded next to each indicator in the KRI register or the management dashboard. For a payment service with a 6-hour MAO, an outage clock crossing 2 hours may trigger crisis-team activation — one third of the limit, leaving time to act. Many organisations use two levels, amber for heightened monitoring and red for mandatory escalation.

A typical failure is setting thresholds once and never recalibrating them, or setting them so wide they never fire — an indicator without a working threshold is decoration. Another is copying thresholds from a template instead of deriving them from the organisation's own limits. How appetite, limits and thresholds connect is covered in ERGP module M2 on risk.