Which of the following should NOT be part of the Risk Management Infrastructure?

Define the organization's definition of risk management as articulated by the Board in clear and uncertain terms

Include financial risk management, compliance and external reporting and, to the extent that resources allow, should exclude legal or accounting

Be independently staffed and report to an employee who is on the Executive Committee (Operating Committee) but who is NOT a business unit leader

Review continually the application of the Principles of Good Governance to the Risk Management Infrastructure, financial accounting and reporting infrastructure and the organization as a whole