If we assume risk management is actually formalised within an institution, then a firm might do well to perhaps consider embedding decision making and appetite into their risk enterprise framework.
A look into why it is so hard to comprehend risk appetite and five tips which improve the quantification of risk appetite on objectives.