The objective of aligning mitigating controls to risk appetite is to ensure that the cost of controls does not exceed the expected loss. The cost of controls is the amount of resources and efforts required to implement and maintain the controls that are designed to reduce the risk exposure. The expected loss is the estimated amount of loss or harm that may result from a risk event. Therisk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. By aligning mitigating controls to risk appetite, the organization can optimize the balance between the cost of controls and the expected loss, and avoid over- or under-investing in controls. Exposures being reduced to the fullest extent,exposures being reduced only for critical business systems, and insurance costs being minimized are other possible objectives, but they are not as relevant as the cost of controls not exceeding the expected loss. References = ISACA Certified in Risk and Information Systems Control (CRISC)Certification Exam Question and Answers, question 8; CRISC Review Manual, 6th Edition, page 97.