Which statement about risk governance is most accurate?

• A. Risk policy is primarily a management responsibility; the board's role is to monitor compliance only.
• B. The board's role includes setting risk policy, monitoring exposure, and ensuring internal controls are effective.
• C. The board should delegate all risk decisions to external consultants.
• D. Risk management is only about financial risk, not operational or strategic risk.

Answer: (B)

Risk governance centers on the board taking an active, ongoing role in shaping how the organization handles risk. The board sets the risk policy and risk appetite, which provide the framework and boundaries for all risk-taking and risk actions. It then monitors the organization’s risk exposure through regular reporting and challenges management on what the numbers and trends show. Crucially, the board also ensures internal controls and assurance mechanisms (like internal audit) are effective, so risks are identified, managed, and mitigated within the approved framework. Management handles day-to-day risk decisions within this policy, but the board retains accountability for the overall risk governance structure and its effectiveness.

That’s why delegating all risk decisions to external consultants misses the essential governance function, and why limiting the board’s role to monitoring compliance is incomplete. Risk management also covers operational and strategic risks, not just financial ones.