The correct answers are: The board; The risk committee; The audit committee.
The board always has ultimate responsibility for risk management. In addition the audit committee and risk committee may be delegated general responsibility. The nomination and remuneration committees have specific remits and general risk management would not normally be part of their remit.
