Which of the following is the BEST way to promote adherence to the risk tolerance level set by management?

A. Avoiding risks that could materialize into substantial losses
B. Increasing organizational resources to mitigate risks
C. Defining expectations in the enterprise risk policy
D. Communicating external audit results