Companies have flexibility under this disclosure requirement to describe how the oversight role is exercised, i.e. whether it is through the activities of the entire board, a risk committee of the board, or another committee of the board, such as the audit committee.