Which of the following should senior management do FIRST when developing and managing digital applications for a new enterprise?

Establishing an architecture review board is a good governance practice but comes after understanding the acceptable risk levels for the solutions it will review.

Defining the risk appetite is a foundational governance activity that establishes the level of risk an organization is willing to accept to achieve its objectives, guiding subsequent decisions on architecture, controls, and risk monitoring. This initial step sets the parameters within which all other development and management activities, including security and operational considerations, will operate.

Developing key risk indicators (KRIs) is a monitoring activity that relies on a previously defined risk appetite to determine what risks are important enough to track.

Implementing a sourcing program is an operational activity related to how resources or services are acquired, which would be influenced by the risk appetite, not precede it.