Who is primarily responsible for setting risk policy in many governance structures?

• A. The audit committee
• B. The board of directors
• C. The CEO alone
• D. The external auditors

Answer: (B)

The board of directors is responsible for setting risk policy because it provides the overarching governance and stewardship, determining the risk appetite and the framework within which the organization operates. This top-level policy ensures that strategy, values, and regulatory expectations align with how much risk the company is willing to accept and how that risk will be identified, assessed, monitored, and managed. Management then runs the business within that policy, designing and implementing the processes to keep risk within approved boundaries. The CEO and executive team handle day-to-day risk management and execution, but they do not set the enduring policy. The audit committee may supervise risk management processes and internal controls, and external auditors provide independent assurance, but neither typically sets the policy itself.