Exam CISA topic 1 question 1386 discussion

Risk policies are specifically crafted to define an organization's risk appetite and tolerance levels. They outline the acceptable level of risk the organization is willing to take to achieve its objectives. Reviewing risk policies provides clear insight into the organization's stance on risk and helps establish guidelines for risk-taking activities across different departments and functions. Therefore, examining risk policies would offer the most useful information about risk appetite during the audit process.