"Additionally, the organization's tolerance for risk is a factor." . . . .