Define risk appetite by category, set thresholds, and name the escalation path when a reading or residual rating crosses the line. Built so the board can approve a statement and operators can act against it.