Who is responsible for setting the risk appetite?

The board of directors is responsible for setting the risk appetite of the organization. They define the level and type of risk the organization is willing to accept in pursuit of its goals and objectives. This strategic role ensures that the organization's risk management framework aligns with its long-term vision and governance structure.

IIA guidance on governance and risk management