What is the role of the board in risk management and compliance oversight?

• A. The board sets risk policy, monitors risk exposure, and ensures management complies with laws and internal controls.
• B. The board handles daily operations of risk management.
• C. The board only approves annual budgets and has no oversight role in risk.
• D. The board delegates all risk issues to external consultants.

Answer: (A)

The board’s role in risk management and compliance is to govern, not to run the day-to-day activities. It sets the organization’s risk policy and risk appetite, oversees ongoing risk exposure, and ensures there are robust internal controls and a culture of legal and regulatory compliance. Through regular risk reporting and review, the board monitors whether management acts within the approved risk framework and takes corrective action when exposures drift beyond tolerance. This oversight is supported by committees (like audit or risk committees) but remains the board’s ultimate responsibility, reflecting fiduciary duties to protect the organization and its stakeholders.

Daily risk operations are run by management and dedicated risk staff, not the board. Merely approving annual budgets doesn’t capture the continuous, holistic oversight required for risk. Delegating all risk issues to external consultants would undermine the board’s duty to govern and ensure compliance; consultants can advise, but the board must retain responsibility for risk governance and internal controls.