Control activities will not be fully effective until everyone , from the person on the counter through to the head of the agency , takes responsibility for managing risk from the perspective of their respective positions .
For control activities to be as effective as possible , it 's enough for the head of the agency to take personal responsibility in the management of risk in his or her position .