Risk assessment is an inexact science. One of the key factors in evaluating risk and developing a risk mitigation strategy is the tolerance for risk, which can be inexact as well. What are some of the key factors in determining risk tolerance? How do you determine how risk tolerance within an organization?

Based on your experience, do you consider your organization to be risk tolerant or risk averse?