A fundamental part of risk management is not only understanding the risks the company faces and what steps management is taking to manage these risks, but also understanding what level of risk is acceptable.