The CBB expects the Board to be able to demonstrate that it provides suitable oversight and establishes, in relation to all the risks the investment firm licensee is exposed to, a risk management framework that includes setting and monitoring policies, systems, tools and controls.