> ensures the necessary separation of operating and control activities, so as to prevent or – where that is not possible – mitigate conflicts of interest; > guarantees the traceability of the tasks of identifying, assessing, managing, and monitoring risks, ensuring the reconstruction of the sources over time and the information that supports these tasks.