Which of the following BEST facilitates the identification of appropriate key performance indicators (KPIs) for a risk management program?

Reviewing control objectives helps define what controls should achieve, but it doesn't directly inform how to *measure* the overall performance of the risk management program in relation to the organization's risk acceptance.

Aligning with industry best practices can provide a starting point for KPIs, but these practices may not be perfectly tailored to an organization's specific context or unique risk appetite.

Consulting risk owners is valuable for identifying specific risks and controls in their areas, but it doesn't provide the overarching strategic guidance for KPI selection that aligns with the organization's holistic risk appetite.

Risk appetite defines the level of risk an organization is willing to accept, and appropriate KPIs for a risk management program must directly measure performance against this tolerance. By evaluating KPIs in accordance with risk appetite, the organization ensures that the metrics chosen are relevant, provide actionable insights, and accurately reflect whether the risk management program is effectively keeping risks within acceptable boundaries.