The board must monitor management adherence to the risk appetite and tolerance statement and provide for timely detection and remediation of breaches.