Exam CRISC topic 1 question 1141 discussion

Heatmap doesnt talk about risk appetite, hence policies is the answer

Going with C. Risk appetite statements are documented.

Policies and procedures are an effective way to enable senior management to communicate risk appetite to the organization. Policies and procedures are formal documents that outline the expectations and requirements of an organization in terms of risk management. They provide guidance to employees on the types of risks that are acceptable and those that should be avoided. They also describe the controls and processes that are in place to manage risks and ensure compliance with regulatory requirements.

Policy and procedures

Policies is answer