3.2 review the policies and practices with respect to risk assessment and risk management and the internal control environment in the area of classified business activities, including discussing with management any major financial risk exposures and the steps that have been taken to monitor and control such exposure, and in connection with such activities shall have access to the Corporation???s i