Which of the following stakeholders define risk tolerance for an enterprise?

IT compliance and IT audit functions assess adherence to risk policies and controls but do not set the overarching risk tolerance for the enterprise.

Regulators and shareholders influence an organization's risk profile through external requirements and expectations, but they do not directly define the internal risk tolerance.

The board of directors and executive management are responsible for the overall governance and strategic direction of the enterprise. They establish the organization's risk appetite and risk tolerance, which represent the maximum level of risk the organization is willing to accept to achieve its objectives, and the acceptable deviation around those levels, respectively.

Enterprise Risk Management (ERM) programs implement and manage risks within the defined tolerance, but ERM itself does not define the tolerance; it operates within the boundaries set by leadership.