Activities may include, and are not limited to: n Reviewing and providing feedback on risk and compliance items, n Reviewing the results of annual risk identification and refresh processes, n Approving the addition or removal of risks (enterprise, operational and compliance) to the organization’s risk register, n Overseeing progress of mitigation activities through to completion, including an assessment of whether the objective was met, n Approving risk analyses and mitigation strategies that consider alternative analyses and the acceptable level of risk, n Approving and monitoring metrics for key risks and compliance requirements, n Reviewing progress on compliance training, and n Monitoring progress toward risk-reduction objectives.