Which of the following should be the MAIN consideration when validating an organization’s risk appetite?