The amount of risk that an entity prefers to assume in the pursuit of its strategy and business objectives, knowing that management will implement, or has implemented, direct or focused actions to alter the severity of the risk.
Sources:
NISTIR 8286
from
COSO Enterprise Risk Management