A risk management policy outlines the organization’s approach, principles, and guidelines for managing risks, reflecting its risk appetite and compliance requirements.