Which of the following is the BEST criterion to determine whether higher residual risk ratings in the risk register should be accepted?

Risk maturity refers to the sophistication and effectiveness of an organization's risk management processes, not a criterion for accepting specific risk levels.

Risk policy outlines the general approach and principles for managing risk, but risk appetite provides the specific boundary and quantitative/qualitative measure for risk acceptance.

Risk appetite establishes the level of risk that an organization is willing to tolerate to achieve its objectives, serving as the benchmark for acceptable risk. Therefore, residual risks, which are those remaining after controls have been implemented, should be accepted if and only if they fall within the organization's formally defined risk appetite.

Risk culture describes the collective attitudes and behaviors toward risk within an organization, which influences risk appetite but is not the formal criterion for accepting individual risks.