Approval authority for risk decison making must be established and published by the?

Approval authority for risk decision-making must be established and published by the organization's senior management or governing body. This ensures clarity in roles and responsibilities, allowing for effective risk management practices. By defining who has the authority to make risk-related decisions, organizations can streamline processes and enhance accountability. Additionally, communicating this authority helps ensure that all stakeholders understand the risk governance framework.