An organization has committed to a business initiative with the knowledge that the risk exposure is higher than the risk appetite. Which of the following is the risk practitioner's MOST important…

Recommending rejection would be appropriate before the commitment, but once the organization has committed with full knowledge, the practitioner's role shifts to managing the accepted risk.

Changing the risk appetite is a strategic decision made by senior management, not a direct action for a risk practitioner in response to a single initiative; it would typically be a broader, longer-term adjustment.

If senior management or the relevant risk owner makes an informed decision to proceed with an initiative despite the risk exposure being higher than the defined risk appetite, it constitutes a formal acceptance of that heightened risk. The risk practitioner's crucial role is to ensure this decision is officially documented, providing an audit trail and clear accountability.

Initiating a reassessment might be part of an ongoing process, but the immediate and most important action when an over-appetite risk is accepted is to document that acceptance, as the assessment has already shown it's above appetite.