A tolerance band is the range within which a metric can move without requiring a response. It is the operational expression of risk appetite, translated from a statement into a number with edges.
Every metric varies for reasons that have nothing to do with performance. Month lengths differ. A large deployment lands. A subsidiary reports late. An asset class is reclassified.
A single pass and fail line treats all of that variance as signal. The result is a review process that fires constantly and, within two quarters, is being waved through as routine.
The band absorbs ordinary variation so that the edges mean something when they are reached.
From the metric’s own history, not from intuition.
Take twelve to eighteen periods of stable operation and look at how much the value moved when nothing notable happened. The band should sit at the outer edge of that ordinary movement. Anything inside is noise. Anything outside is worth a question.
Where history is short, set the band deliberately wide and narrow it as the distribution becomes clear. Starting narrow and loosening it later is worse, because every loosening looks like a retreat.
Most bands should not be symmetric. For a coverage metric, movement downward matters and movement upward usually does not. For a mean time to respond, the reverse.
A suspiciously good reading still deserves a look, though for a different reason. It is more often a data problem than an improvement. A coverage figure that jumps ten points in a period is usually a population change rather than a deployment success. See baseline.
The band’s edges should be traceable to something written down. A risk appetite statement, an agreed protection level, a regulatory expectation.
Where they are not, the band is one person’s judgement, and it will be relitigated every time it is breached.
From the blog