Which of the following represents the clearest distinction between the responsibilities of the board of directors and senior management in the context of fraud risk management?