The Board of Directors or equivalent authority must take responsibility for the establishment and oversight of effective risk management and internal controls.