Who is held responsible for oversight of the organization's risk management framework?

The oversight of an organization's risk management framework is primarily the responsibility of the board of directors. The board's role includes ensuring that risk management processes are integrated with overall organizational processes and that the strategies and policies regarding risk management are effectively managed and aligned with the organization’s objectives. Operational management, internal auditors, and the head of risk management each play roles within the framework established by the board but do not have overall oversight responsibility.

Institute of Internal Auditors (IIA) - International Professional Practices Framework (IPPF)