It is the Senior Management who decides the appetite of the organization

People pose the biggest risk in the organization.
People form the biggest risk as they can expose the sensitive data accidentally or on purpose.
Disgruntled employees or careless employees form a great threat to the organization.

Even after cloud migration. cloud customer is responsible for the data and ultimately liable for any data loss or breaches.

A workload is a unit of processing, which can be in a virtual machine, a container, or other abstraction.
Workloads always run somewhere on a processor and consume memory. Workloads include a very diverse range of processing tasks, which range from traditional applications running in a virtual machine on a standard operating system, to GPU- or FPGA-based specialized tasks Reference: CSA Security Guidelines V.4(reproduced here for the educational purpose)

IS027005 standards describes IT Risk Management process