This excerpt taken from the CVS DEF 14A filed Apr 4, 2007.
Limitations Inherent in the Audit Committees Role
It is not the duty of the Audit Committee to plan or conduct audits or to determine that the Companys financial statements are complete and accurate and are in accordance with GAAP and applicable rules and regulations. This is the responsibility of management and the independent auditor. Furthermore, while the Audit Committee is responsible for reviewing the Companys policies and practices with respect to risk assessment and management, it is the responsibility of the CEO and senior management to determine the appropriate level of the Companys exposure to risk.