What term sets the direction and strategy of risk management efforts and defines acceptable levels of risk?

• A. Risk management
• B. Risk statement
• C. Risk governance
• D. Risk scope

Answer: (C)

Risk governance is the framework that sets the direction and strategy for how risk is managed across the organization. It establishes policies, risk appetite and tolerance, and the oversight structure that assigns accountability for risk decisions. Through governance, senior leadership and the board define what levels of risk are acceptable, guiding how risks are identified, assessed, prioritized, and mitigated. This overarching framework ensures risk management activities align with strategic objectives and resource priorities, rather than being ad hoc or isolated to individual departments.

Risk management describes the ongoing process of identifying and addressing risk, but it does not set the direction or define acceptable risk levels. A risk statement expresses the description of a risk, not the governance framework. Risk scope defines the boundaries of the risk management activities, not the overarching direction or appetite.