Our management has day-to-day responsibility for managing risk arising from our activities, including making decisions within stated Board-delegated authority; seeking to ensure that employees understand their responsibilities for managing risk through a “three lines of defense” model; and establishing internal controls as well as guidance and standards to implement the risk management policy.