Isaca IT Risk Fundamentals Exam - Topic 4 Question 27 Discussion

The board of directors is ultimately accountable for risk governance. While ERM, business units, and IT management all play crucial roles in managing risk, the governance of risk---setting the overall risk appetite, defining roles and responsibilities, and monitoring the effectiveness of risk management---rests with the board. They provide oversight and direction, ensuring that risk management is integrated with the organization's strategic objectives. The board's responsibility stems from their fiduciary duty to the organization and its stakeholders. They are responsible for the overall success and sustainability of the enterprise, which includes effectively managing risks.