How do corporate governance codes guide risk oversight?

• A. They mandate a fixed risk budget for all firms.
• B. They require annual risk assessments but have no impact on governance structure.
• C. They provide guidance on board composition, risk committees, internal controls, disclosure, and accountability.
• D. They replace the need for internal controls.

Answer: (C)

Corporate governance codes guide risk oversight by detailing how governance structures and processes should work to monitor and manage risk. They commonly describe how boards should be composed to ensure independent, informed oversight; establish risk committees with clear mandates to oversee risk appetite, risk management frameworks, and escalation processes; require robust internal controls and internal audit functions; call for timely, transparent disclosure of risk information to shareholders; and assign accountability for risk outcomes to both the board and executive leadership. This combination—board makeup, dedicated risk oversight bodies, controls and assurance activities, transparency, and clear accountability—gives firms a framework for integrating risk management into daily governance and decision-making. The other options miss this comprehensive, structural role: risk budgets are not mandated uniformly by codes; annual risk assessments do not by themselves shape governance structures; and codes do not replace internal controls, but rather reinforce and harmonize them with governance practices.