How is risk tolerated in your organization?