the committee is required to: consider the nature and extent of the risks facing the group; keep these risks under review; review the framework to mitigate such risks; and notify the board of changes in the status and control of these risks.