The board has not delegated responsibility for risk oversight and therefore does not receive regular reports on the organization’s most significant risks. This...