The board of directors holds a crucial oversight function focused on strategic risk management. Their responsibility is not to ensure controls for every single activity, but to ensure that the control systems are appropriate for the specific risks the organization faces. This aligns with modern governance frameworks that advocate for a risk-based approach. The board must ensure that management has implemented a sound system for identifying, measuring, managing, and reporting on the principal risks to achieving the company's strategic objectives. This ensures that controls are both effective and efficient.

A. Control systems that cover all activities.

This is impractical and inefficient. A risk-based approach, which the board oversees, prioritizes controls on activities with significant risk, not necessarily all activities.

C. Traditional internal control systems.

This is too narrow and potentially outdated. The board's duty is to ensure controls are effective against current and emerging risks (e.g., cybersecurity), not just historical ones.

1. OECD. (2023). G20/OECD Principles of Corporate Governance. OECD Publishing, Paris. Chapter VI, "The responsibilities of the board," Section D, states the board is responsible for "ensuring the integrity of the corporation’s accounting and financial reporting systems... and that appropriate systems of control are in place; in particular, systems for risk management, financial and operational control..." (p. 49).

2. The Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2013). Internal Control – Integrated Framework: Executive Summary. The framework explicitly assigns oversight responsibility for the system of internal control to the board of directors. The entire framework is built on achieving objectives by managing risks, with "Risk Assessment" being a core component the board must oversee (pp. 4-5).

3. Solomon, J. (2020). Corporate Governance and Accountability (5th ed.). Wiley. In discussions on the role of the board, the text emphasizes the shift towards a proactive, risk-based oversight function, stating, "A key role for the board is to ensure that a sound system of internal control and risk management is in place to safeguard shareholders’ investment and the company’s assets" (Chapter 7, The Role of the Board in Corporate Governance).