A risk appetite statement is:

• A. A formal declaration of acceptable risk levels; approved by the legal department.
• B. A description of risk thresholds reviewed annually by the project team.
• C. A formal declaration of acceptable risk levels; approved by the risk committee.
• D. A formal declaration of acceptable risk levels; approved by senior leadership or the board.

Answer: (D)

A risk appetite statement defines how much risk the organization is willing to take in pursuit of its objectives and signals guiding principles for decision-making across the enterprise. It should reflect strategy and sit within governance so decisions at all levels stay aligned with what the organization is prepared to accept.

The best answer is that it is approved by senior leadership or the board because this top-level approval ensures the statement truly reflects strategic direction and provides legitimate governance over risk taking. Board or senior leadership endorsement binds the organization to a defined risk posture and ensures consistency with objectives, capital allocation, and overall risk capacity.

Approvals by the legal department or purely project-level reviews do not provide that broad, strategic authorization. While risk committees may review and advise, the formal declaration of the organization’s risk appetite typically rests with the board or senior leadership to maintain governance and accountability across the whole enterprise.