An analyst at a local bank is drafting an internal training document summarizing the risk management responsibilities of different business functions in the bank. The analyst starts by describing the responsibilities of the board of directors. Which of the following is correct for the analyst to include as a responsibility of the board of directors?