You must have a clear set of roles and responsibilities relating to risk including who owns risks and how they are escalated and delegated.