Oversight is provided by the Executive Risk Committee, comprised of the CEO staff, which meets twice per year to review progress, evaluate present and emerging risks, and validate the program has identified the correct principal risk area to focus on.