Risk policies provide the best indication of an organization's risk tolerance, as they define the acceptable level of risk and the risk appetite of the organization. Risk policies also establish the roles and responsibilities, methodologies, and reporting mechanisms for risk management. Risk sharing strategy, risk transfer agreements, and risk assessments are not the best indicators of risk tolerance, as they are more related to risk response, risk mitigation, and risk identification, respectively. References = Risk and Information Systems Control Study Manual, 7th Edition, Chapter 1, Section 1.2.1.2, page 19.