Which of the following should be the PRIMARY area of focus when reporting changes to...

Risk tolerance represents the acceptable deviation from the organization’s risk appetite. Any change in the risk profile that surpasses the defined tolerance must be reported to executives. This enables risk-informed decision-making and adjustment of mitigation strategies. It ensures the business stays within defined risk boundaries.