Which of the following should NOT be part of the Risk Management Infrastructure?
A . Define the organization’s definition of risk management as articulated by the Board in clear and uncertain terms
B . Include financial risk management, compliance and external reporting and, to the extent that resources allow, should exclude legal or accounting
C . Be independently staffed and report to an employee who is on the Executive Committee (Operating Committee) but who is NOT a business unit leader
D . Review continually the application of the Principles of Good Governance to the Risk Management Infrastructure, financial accounting and reporting infrastructure and the organization as a whole
Answer: D