To effectively communicate the acceptance of risk in an organization, a chief audit executive must first consider the organization's view on risk tolerance. This is because understanding how much risk the organization is willing to accept is foundational to evaluating and discussing risk-related matters. Without a clear view of the organization's risk tolerance, other aspects such as principal risk events, risk response strategies, or control activities cannot be properly contextualized or prioritized.