The Board executes its risk management responsibility directly and through its committees. As set forth in its charter and annual work plan, Audit Committee has primary responsibility for overseeing their enterprise risk management process. The Audit Committee receives updates and discusses individual and overall risk areas during its meetings, including financial risk assessments, operations risk management policies, major financial risk exposures, exposures related to compliance with legal and regulatory requirements, and management's actions to monitor and control such exposures. The Vice President of Internal Audit reviews with the Audit Committee company's annual operational risk assessment results and at least once each quarter the results of internal audits, including the adequacy of internal controls over financial reporting. The Vice President of Internal Audit and Chief Information Officer report to the Audit Committee on information systems controls and security.