Optimized risk management is achieved when risk is reduced to meet risk appetite, which is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. Risk appetite reflects the strategic goals and priorities of the organization, as well as its risk culture and tolerance. Reducing risk with strategic initiatives, within resource availability, or below risk appetite are all possible approaches, but they do not necessarily optimize risk management, as they may result in over- or under-investment in risk mitigation, or misalignment with business objectives. References = Risk and Information Systems Control Study Manual, Chapter 2, Section 2.2.2, page 47