Policy, Program and Procedures

Who determines risk appetite/risk tolerance levels for an organization?

If there is a delay in defining the risk appetite and tolerance levels, can the TPRM team proceed with determining them to avoid further delays in the development of the TPRM program?

My experience is that risk management function with input from the business functional units and senior management determine the appetite.