What is the board's role in risk management and compliance oversight?

• A. The board handles all day-to-day risk decisions.
• B. The board only focuses on stock valuations.
• C. The board delegates risk policy entirely to management without oversight.
• D. The board establishes risk policy, monitors risk exposure, and ensures management operates within the risk framework and complies with laws.

Answer: (D)

The main idea here is that governance and accountability for risk rests with the board. The board should set the organization’s risk policy and risk appetite, establish the framework that defines how much risk is acceptable, and ensure there are controls and processes to monitor exposure. It also has to oversee that management operates within that framework and complies with applicable laws and regulations. This is why the board reviews risk reports, approves major risk policies, and ensures an effective risk and compliance program is in place.

Day-to-day risk decisions are the responsibility of management, not the board, so answering that the board handles daily risk choices would misstate the balance of duties. Focusing only on stock valuations oversimplifies risk governance, which spans all material risks beyond price movements. Delegating risk policy entirely to management without ongoing board oversight would abandon the essential governance role that the board must retain.