risk in ERM-Schweser V2 page 335 third afternoon exam Q44

Schweser V2 page 335 third afternoon exam Q44, It is mentioned that upper management should be able to measure risk, I don’t agree, it should be the risk analyst/associate to measure the risk, isn’t it?