Which activity should be done by governance?

A. Implement risk appetite
B. Set principles and policies
C. Execute strategy
D. Plan activities to meet enterprise goals