Which of the following best describes the primary governance responsibility of the Board of Directors regarding an organization's compliance and ethics program?

Under the Caremark doctrine and various regulatory guidelines (such as the US Federal Sentencing Guidelines), corporate boards of directors have a non-delegable duty to oversee the company's compliance and ethics program. However, there is a distinct boundary between governance (the board's role) and management (the compliance officer's role). The correct answer is establishing strategic oversight to ensure the program is effective, independent, and supported with sufficient resources, because the board's primary responsibility is strategic oversight. The board must ensure that management has established an effective compliance program that is operational, has sufficient authority, operates independently, and is adequately resourced (with budget, technology, and staff) to meet the organization's risk profile. The board exercises this oversight by reviewing regular reports, questioning the CCO, and setting the tone at the top. Managing the day-to-day administrative operations and employee training schedules of the compliance team is incorrect because day-to-day management of compliance operations is the responsibility of the Chief Compliance Officer and the compliance staff, not the board. Conducting the hands-on interviews and evidence gathering for all internal investigations is incorrect because conducting internal investigations is an operational task delegated to investigators, compliance personnel, or external counsel, though the board should be informed of high-level or sensitive investigation findings. Exclusively handling the preparation of financial audits and budget spreadsheets for the compliance department is incorrect because while the board approves the budget as part of its resource allocation responsibility, its role is not limited to financial numbers, nor does it prepare the budget spreadsheets themselves.