An organization's IT risk appetite should be primarily driven by its strategic objectives. The risk appetite defines the amount and type of risk the organization is willing to pursue or retain to achieve its goals.
Aligning risk appetite with strategic objectives ensures that risk-taking is consistent with the organization's mission and vision. While ROI, cost of controls, and the likelihood of risk events are important considerations in risk management, they are factors evaluated within the context of the overarching strategic objectives.
References:
* ISACA CISA Review Manual, 28th Edition, Chapter 2: Governance and Management of IT.