Choice "A" is correct. Generally, an organization's risk appetite has been exceeded when the combined likelihood and impact of negative events significantly exceed residual risk. Residual risk represents the risk that remains after management has taken actions to mitigate negative events. If the likelihood and impact of those negative events significantly exceeds the residual risk, the operation is likely to exceed the organization's risk appetite.
Choice "b" is incorrect. An organization's risk appetite may go beyond the risk that they control. When the likelihood and impact of negative events exceeds residual risk, management will need to carefully evaluate their actions, but they may not have exceeded their risk appetite.
Choice "d" is incorrect. Positive events represent opportunities. If those opportunities are within residual risk, then the opportunity will likely be pursued.
Choice "c" is incorrect. Positive events represent opportunities. If those opportunities are significantly below residual risk, then the opportunity will likely be pursued.