Impact tolerance: the ceiling, not the target

Two numbers, two logics

The RTO is an internal commitment: "we will return this system to service within four hours".

Impact tolerance is an external limit: "beyond six hours of disruption to this service, the harm caused to our clients and to the market becomes intolerable".

The RTO looks inward. Tolerance looks outward. Three practical consequences follow.

First consequence. Tolerance is set without regard to feasibility. You do not ask "how fast can we restart?" but "at what point does this become unacceptable?". If the gap between the two is wide, that is strategic information, not a methodological problem.

Second consequence. An organisation can meet every one of its RTOs and still breach its tolerance. It suffices for the chain to have five four-hour links.

Third consequence. Tolerance is expressed from the client's viewpoint. A service can be technically restored and still be unavailable to the client, because the accumulated backlog takes eight hours to clear.

How to set a tolerance

Four questions, put to the board:

1. How many clients are affected, and how many of those are vulnerable or without alternatives?
2. What concrete harm do they suffer: direct financial loss, inability to reach their funds, delayed care, supply interruption?
3. Beyond what duration does that harm become irreversible or disproportionate?
4. What effect on the market or on sector confidence if the situation persists?

The answer is expressed in time: "24 hours", "4 hours during the tax filing window". It is board-approved, documented, and reviewed annually.

The unit may not be time

For some services, duration is not the right metric. A payment service may tolerate two hours of unavailability but no amount errors at all. Tolerance is then expressed in volume, error rate, or number of clients affected.

The rule: tolerance is expressed in the unit that captures actual harm, not the one easiest to measure.