Management is responsible for identifying risk and risk controls related to significant business activities; mapping the risks to company strategy; and developing programs and recommendations to determine the sufficiency of risk identification, the balance of potential risk to potential reward, and the appropriate manner in which to control risk.