COSO Enterprise Risk Management (ERM) Framework (2017) P1: Principle 1: Exercises Board Risk Oversight

The board oversees the strategy and discharges its governance duties so that management is supported in delivering the strategy and business objectives. The board holds primary responsibility for risk oversight (in many countries a fiduciary one), keeps day-to-day risk management with management, and commonly states the respective responsibilities of board and management, whether the full board retains oversight or delegates to a risk committee; it brings the collective skills, experience and business knowledge to challenge management on strategy, objectives and performance targets and reviews its own composition as the business context changes (an entity exposed to cyber risk may need that expertise on the board or through advisers); it is independent, each director able to be objective and free of the interests, relationships and tenure that impede independence; it discusses with management whether enterprise risk management is designed well enough, given how complex the entity is, to add value; and it watches for organizational bias in decision-making, such as forceful personalities, too much faith in numbers, ignoring information that points the other way, and giving recent events too much weight.