Risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite can be expressed in qualitative or quantitative terms, and can vary depending on the context and the stakeholder. Risk appetite should be defined and communicated by the senior management or the board of directors, and should guide the risk management decisions and actions throughout the organization. When a project team has accepted a risk outside the established risk appetite, the risk practitioner's best course of action is to escalate the risk decision to the project sponsor for review, meaning that the risk practitioner should report the risk acceptance and its rationale to the project sponsor, who is the person or group that provides the resources and support for the project, and is accountable for its success. The project sponsor should review the risk decision and determine whether it is aligned with the organization's objectives and strategy, and whether it requires any further approval oraction. References = Risk and Information Systems Control Study Manual, Chapter 1, Section 1.3.1, p. 25-26