194. The Board should –

(a) determine the levels of risk tolerance and the nature and extent of significant risks it is
willing to embrace in achieving its strategic objectives;
(b) determine whether or not it is desirable to establish a risk management committee to
assist it in carrying out its risk related responsibilities or in formulating such
committee’s terms of reference or reviewing and monitoring the committee’s
performance;
(c) formulate, implement and review the company’s risk management policy and plan; and
(d) integrate the company’s risk policy and plan into the day to day activities of the
company.

195. The Board should ensure that processes are established to foster the complete, timely,
relevant, accurate and accessible risk disclosures to the shareholders.

196. The Board may, if deemed desirable, appoint a risk management committee to assist it in the
discharge of its duties and responsibilities in respect of risk management.