The MAIN responsibility of the board of directors regarding the management of enterprise risk is to:

The board of directors holds the ultimate responsibility for the governance of enterprise risk. Their primary role is not to manage risk directly but to provide oversight and direction. This involves defining the enterprise's risk appetite—the amount and type of risk the organization is willing to accept in pursuit of its objectives. Consequently, the board's main responsibility is to ensure that a comprehensive risk management framework and associated processes are established by management to identify, assess, and manage risks in alignment with this board-approved appetite. This oversight function ensures that risk management is embedded in the enterprise's strategic and operational activities.

B. This is a specific management activity. While the board ensures adequate resourcing, it does not typically involve itself in the details of staff training programs.

C. Promoting a benefits-driven culture is related to value creation, but the board's main responsibility for risk management is specifically about value preservation and managing uncertainty.

D. Maintaining awareness is a component of the board's role, but it is a passive state. Their primary responsibility is more active: to ensure a system is in place to manage risk, not just to be aware of it.

---

1. ISACA

COBIT® 2019 Framework: Governance and Management Objectives

2018.

Reference: Governance Objective EDM03

Ensured Risk Optimization.

Details: This objective explicitly states that the role of the governance body (the board) is to "Direct the establishment of a risk management approach to ensure that risk is managed in line with the enterprise’s risk appetite." (p. 37). This directly supports the board's responsibility to ensure a process exists that addresses the risk appetite.

2. ISACA

CGEIT Review Manual

8th Edition

2020.

Reference: Domain 4

Risk Optimization

Task Statement RO1.1.

Details: This section emphasizes that a key task for governance is to "Evaluate and direct the establishment and maintenance of a risk management framework." The manual clarifies that the board is accountable for risk governance

which includes setting the risk appetite and ensuring that management implements a framework to manage risk accordingly.

3. De Haes

S.

& Van Grembergen

W. (2015). Enterprise Governance of Information Technology: Achieving Alignment and Value

Featuring COBIT 5. Springer International Publishing.

Reference: Chapter 3

"Implementing IT Governance

" Section 3.2.1

"Board of Directors."

Details: The text describes the board's role in setting the tone at the top for risk management. It states

"The board should understand the enterprise’s risk appetite and ensure that the risk management framework is appropriate for the enterprise." This academic source reinforces that the board's duty is to ensure the existence and appropriateness of the risk process relative to its stated appetite.