Which of the following is MOST important to update following a change in organizational risk appetite and tolerance?

A Business Impact Assessment (BIA) analyzes the effects of disruptive events on business functions, which is generally updated when processes change, not primarily due to changes in risk appetite.

Key Performance Indicators (KPIs) measure performance against objectives and controls; while they may be adjusted, the risk profile is the foundational document that defines what is acceptable.

The risk profile is a comprehensive view of the organization's current risk landscape, including how risks align with its appetite and tolerance. When appetite or tolerance changes, the entire risk profile must be re-evaluated and updated to reflect the organization's new strategic stance on risk.

Industry benchmark analysis provides external context, but it is not the primary internal document to update when an organization's specific internal risk posture changes.