Volume 2 — Governance and ControlsGovernance and Controls © Copyright 2002, All rights reserved 5 2.1 Board of Directors The board, which has oversight responsibility for the financial health of the company, must oversee trading and marketing operations. The company’s energy market participation must be clearly understood at the board level. The board must understand the company’s risk management objectives, risk tolerance, and overall risk management framework and conduct ongoing formal communications with management. It is recommended that the board detail the specific board reporting requirements of the ROC. Board of Directors ― Responsibilities and Duties • Establish appropriate board committees, with formal charters and director qualifications. • Understand trading and marketing strategies and associated risk. • Discuss guidelines and strategic policies that govern the process by which senior management and the ROC assess and manage risks.2 • Understand the company’s risk management objectives and risk tolerances. • Discuss a strategic risk policy that establishes an overall framework for risk management. • Discuss the company’s major financial risk exposures and the steps management has taken to monitor and control such exposures.2 • Establish scope and frequency for management reporting to the board. • Review compensation policies to ensure that they are structured so as to avoid incentives for excessive risk taking (compensation policies are typically reviewed by a compensation committee). 2.2 Risk Oversight Committee Membership of the ROC includes, at a minimum, the CRO, CFO, and senior management of the energy trading and marketing organization. The ROC should not predominantly consist of front office representatives. The ROC establishes a forum for discussion of the company’s energy trading and marketing operations and must develop guidelines required to implement an appropriate risk management control infrastructure this includes implementation and monitoring of compliance with the company’s risk policy. The ROC executes its risk management responsibilities through direct oversight and prudent delegation of its responsibilities to the corporate risk management department and/or middle office, as well as to other corporate and business unit personnel. 2The NYSE Corporate Accountability and Listing Standards recommend that these activities be an audit committee responsibility.