Management is responsible for approval of the framework for: enterprise risk management; policy review and recommendations; risk management policies and processes; monitoring and reporting of compliance with the policies and processes; and conducting risk mitigation activities within specific operational areas.