Management is further responsible for developing programs and recommendations to determine the sufficiency of risk identification, the balance of potential risk to potential reward, and the appropriate manner with which to control risk.