The role of the board and management in identifying and assessing risks involves the following:

1. Risk Identification and Assessment:
   Management is primarily responsible for identifying key risks, assessing them, and designing appropriate controls. However, the board should set the company’s risk policy and ensure that risks are managed within the framework provided.
2. Board’s Role in Oversight:
   The board provides oversight to ensure that risk management processes are effective and aligned with the company’s objectives. It ensures that management implements an effective risk management system and regularly reviews reports on risk exposures.
3. Setting Risk Appetite:
   The board defines the risk appetite of the organization, ensuring that all identified risks are within acceptable limits and policies are in place to handle them effectively.
4. Annual Risk Review:
   The board conducts an annual review of the effectiveness of risk management practices, ensuring the company is adequately equipped to manage any emerging risks.
5. Communication and Reporting:
   Management regularly reports to the board on key risks and their management, ensuring timely communication of risk exposures.