Risk assessments are most effective when performed at each stage of the system development life cycle (SDLC). The SDLC is a framework that defines the phases and activities of developing, implementing, and maintaining a system. The SDLC typically consists of the following stages: initiation, planning, analysis, design, development, testing, implementation, and maintenance. Performing risk assessments at each stage of the SDLC helps to identify, analyze, and evaluate the risks that could affect the system objectives, requirements, functionality, quality, or performance. Performing risk assessments at each stage of the SDLC also helps to select and implement the appropriate risk responses, such as avoiding, transferring, mitigating, or accepting the risks. Performing risk assessments at each stage of the SDLC also helps to monitor and report the risk status and performance, and to update and adjust the risk assessment and response as the system changes or evolves. Performing risk assessments before system development begins, at system development, or during the development of the business case are not as effective as performing risk assessments at each stage of the SDLC, as they are either too early or too late, and they do not capture the full scope and complexity of the system risks. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 49.

Role of the Board and Executive Management:
The board of directors and executive management are responsible for setting the overall strategic direction of the organization, including its risk tolerance.
They have the authority and oversight necessary to define the levels of risk that the organization is willing to accept in pursuit of its objectives.
Defining Risk Tolerance:
Risk tolerance refers to the acceptable level of variation in performance relative to the achievement of objectives. It is essentially the degree of risk the organization is willing to endure.
The board and executive management establish risk tolerance based on the organization's strategic goals, capacity to absorb losses, and regulatory requirements.
Importance of Senior Leadership:
Senior leadership's involvement ensures that risk tolerance is aligned with the organization's overall strategy and risk appetite.
It provides a top-down approach to risk management, ensuring consistency and alignment across the organization.
Comparing Other Stakeholders:
IT Compliance and IT Audit:These functions are responsible for monitoring and ensuring adherence to policies but do not set risk tolerance.
Regulators and Shareholders:They influence risk management practices through external pressures but do not define risk tolerance directly.
Enterprise Risk Management (ERM):ERM frameworks support the implementation of risk management but the actual definition of risk tolerance comes from the board and executive management.
References:
The CRISC Review Manual discusses how senior management, including the board, is responsible for defining risk tolerance and ensuring it aligns with the organization's risk appetite (CRISC Review Manual, Chapter 1: Governance, Section 1.10 Risk Appetite, Tolerance, and Capacity) .

Residual riskrepresents the amount of risk remaining after controls have been applied. Tracking its reduction over time directly indicates whether controls are effectively reducing risk to withintolerance limits.
Reference:CRISC Manual - Domain 4, Slide 384-386

* The three lines of defense model is a framework that describes the roles and responsibilities of different functions in an organization for managing risks and controls.
* The first line of defense is the operational management, which is responsible for implementing and maintaining effective controls, identifying and assessing risks, and reporting on risk and control performance.
* The second line of defense is the risk management and compliance functions, which are responsible for establishing and overseeing the risk management framework, providing guidance and support to the operational management, and monitoring and reporting on risk and compliance issues.
* The third line of defense is the internal audit function, which is responsible for providing independent and objective assurance on the adequacy and effectiveness of the risk management and control system, and recommending improvements.
* Within the three lines of defense model, the accountability for the system of internal control resides with the chief information officer (CIO). The CIO is the senior executive who oversees the IT function of the organization, and is responsible for ensuring that the IT risks and controls are aligned with the business objectives and strategies, and are integrated with the enterprise risk management and governance processes.
The references for this answer are:
* Risk IT Framework, page 20
* Information Technology & Security, page 14
* Risk Scenarios Starter Pack, page 12