An enterprise's board of directors can BEST manage enterprise risk by:

Mandating board-approved ERM modifications is a reactive measure and assumes an ERM framework is already in place; it's not the foundational best step for overall risk management.

Requiring the establishment of an enterprise risk management (ERM) framework provides the overarching structure, principles, and processes for consistent and systematic risk identification, assessment, mitigation, and monitoring across the entire organization, which is fundamental for effective board oversight of risk.

Requiring an enterprise-wide program management office focuses on project/program execution rather than the holistic management of all enterprise risks.

Ensuring the cost-effectiveness of the internal control system is a specific aspect of risk management but not the primary or best way for the board to manage overall enterprise risk.