Risk appetite

This involves defining the level of risk that the organization is willing to tolerate.