The CRO of a bank is conducting an internal assessment of the potential risk and vulnerability of the bank. The CRO starts by evaluating how risk management responsibilities are assigned to and connected across various business functions. Which of the following statements regarding the interdependence of risk management functions is correct?