actions with respect to risk management: (1) establish a written comprehensive risk management policy framework that covers all risk areas, with approval of its board of directors or the working group