$(1)$ Setting policy and strategy for risk management.

$(2)$ Establishing internal risk policy and structures for business units.

$(3)$ Determining and defining the company$$s risk appetite.

$(4)$ Approve and monitor the annual risk management plan.

$(5)$ Building a risk$-$aware culture within the organisation that includes appropriate training.

a$)$ Statements $(1),(2)$ and $(3)$

b$)$ Statements $(1),(2)$ and $(4)$

c$)$ Statements $(1),(2),$ and $(5)$

d$)$ Statements $(1),(3)$ and $(4)$