A company has a general risk appetite statement but no operational limits for a critical service. What should the practitioner help develop?

1. A new general statement with more ambitious language
2. A rule that each technician defines their own appetite
3. Specific tolerance thresholds and escalation criteria aligned with appetite
4. A list of all controls without decision thresholds