Which of the following is the PRIMARY objective of establishing an organization's risk tolerance and appetite?

Aligning with board reporting requirements is an important outcome of risk governance, but it is a secondary benefit rather than the primary objective of defining risk tolerance and appetite.

By clearly defining risk tolerance and appetite, an organization establishes boundaries for the amount of risk it is willing to accept when pursuing objectives. This framework provides critical guidance for management to evaluate various courses of action, helping them make strategic and operational decisions that align with the organization's overall risk posture.

While creating organization-wide risk awareness is a positive byproduct, the core purpose of setting these parameters is to provide concrete guidelines for specific decision-making, not just general awareness.

The objective is not to simply minimize risk mitigation efforts, but rather to optimize them to manage risks within defined acceptable limits, which might involve significant effort depending on the risk.