The board of directors at a financial services firm issues a statement declaring that the organization is generally comfortable pursuing new fintech ventures but is unwilling to accept regulatory violations under any circumstances. The CISO must translate this high-level directive into an operational metric that defines the specific amount of variance from expected outcomes the organization will accept for its anti-money-laundering monitoring system before escalation is required. Which concept does the CISO need to define?