Establish a risk appetite that clearly defines the risks to take and those to avoid, and use it for decision-making under ERM, board approval, and ongoing monitoring. The focus is on the decision criteria and operating framework for risk-taking, rather than on the risk management framework itself.