What is the primary purpose of a risk appetite statement (RAS) in an organization and...

An RAS defines the amount and type of risk an organization is willing to take to achieve its objectives and should be communicated clearly to all stakeholders with corresponding controls implemented

An RAS is a detailed plan for managing operational risks and does not cover strategic or financial risks

An RAS is a formal document meant for regulatory compliance that does not influence day-to-day risk management practices within the organization

An RAS is used to outline the risk tolerance limits to external stakeholders and does not need to be communicated within the organization