I'm studying for the CCSP exam and I'm a little confused on the difference between "Risk Appetite" and "Risk Tolerance". Is there a clear and discernible difference? Can the terms be used interchangeably?
To me, both terms are referring to the amount of risk that an organization (or more accurately, the governance and risk management program at an organization) is willing to take.