The review is a normal responsibility of management.
The review itself, however, will be delegated to the audit committee (the board does not have the time nor the expertise to carry out the review themselves).
The board must provide information on the internal control system and review in the annual accounts.
The review should be carried out at least annually.