To define the risk management strategy which of the following MUST be set by the board of directors?

Operational strategies are typically developed by management to execute objectives, rather than being a foundational element set by the board for risk management strategy.

While the board establishes risk governance, defining the specific 'risk appetite' is the direct and specific element that dictates the level of acceptable risk for the strategy.

Annualized Loss Expectancy (ALE) is a quantitative metric used in risk assessment and is calculated by management, not a strategic parameter set by the board of directors.

The board of directors is ultimately responsible for establishing the organization's strategic direction, and defining the risk appetite is a critical component of this responsibility. Risk appetite sets the overarching boundaries for the level of risk the organization is willing to accept to achieve its objectives, thus forming the essential foundation for the entire risk management strategy.