Establishing a three-tiered risk management structure consisting of the Board of Directors, functional departments, and functional positions to provide strong organizational support for the improvement and effectiveness of internal control systems.