Who approves the risk appetite statement?

• A. The internal audit committee.
• B. The project sponsor.
• C. Senior leadership or the board.
• D. The legal department.

Answer: (C)

Setting and approving the risk appetite statement is a governance decision made at the top of the organization. It defines the maximum level of risk the enterprise is willing to take in pursuit of its objectives, guiding strategy, capital allocation, and day-to-day risk decisions across all units. Because this policy shapes how the entire organization behaves toward risk, it needs the authority of senior leadership or the board who oversee risk governance and policy approval. The internal audit committee may review and challenge the framework and its effectiveness, but it does not typically grant final approval. A project sponsor is concerned with a specific initiative, not the enterprise-wide risk stance, and the legal department provides input on regulatory and contractual risk rather than signing off on overall appetite.