While it is usually management which designs and implements the organisation’s risk management framework, it is the Board’s role to ensure the soundness and usability of the framework for which it is ultimately responsible for. It is no different when it comes to risk management for information technology (IT). Boards