The Board of Directors must make sure that it is fully apprised of risks faced by the company, and that it can make an independent determination that management has implemented and maintained effective enterprise-wide integrated risk management policies and procedures, including internal controls and compliance.