Consistent with the view that private agents are the first line of defense against excessive risk, boards of directors are expected to be actively involved in establishing the overall environment for taking risk, staying informed about the level of risks and how they are managed and controlled, and making sure that senior management is capable and has the resources it needs to be successful.
Management is expected to develop and implement the policies and procedures needed to conduct a banking business in a safe and sound manner. Internal controls, evaluated by an independent internal auditing function, must be sound.