A growing regional bank has added a risk committee to its board. One of the first recommendations of the risk committee is that the bank should develop a risk appetite statement. What best represents a primary function of a risk appetite statement in the enterprise risk management (ERM) framework? To assign risk management responsibilities to specific internal staff members To state specific new business opportunities that a firm is willing to pursue To state a broad level of acceptable risk to guide the allocation of the firm's resources To quantify the level of variability for each risk metric that a firm is willing to accept