A document created by senior management and the board of directors that describes the organization’s risk appetite and risk tolerances, in relation to its business goals. The organization’s overall risk and control framework should align to this document.