To establish an enterprise risk appetite, an organization should:

To establish an enterprise risk appetite, an organization should:
A . normalize risk taxonomy across the organization.
B . aggregate risk statements for all lines of business.
C . establish risk tolerance for each business unit.

View Answer

Answer: C

Explanation:

To establish an enterprise risk appetite, it is essential for an organization to establish risk tolerance for each business unit. Risk tolerance defines the specific level of risk that each business unit is willing to accept in pursuit of its objectives. This approach ensures that risk management is tailored to the unique context and operational realities of different parts of the organization, enabling a more precise and effective risk management strategy. Normalizing risk taxonomy and aggregating risk statements are important steps in the broader risk management process but establishing risk tolerance is fundamental for defining risk appetite at the unit level. This concept is supported by standards such as ISO 31000 and frameworks like COSO ERM (Enterprise Risk Management).