Specifi c policies on the risks of the various businesses The risk policy and its basic principles are specifi ed in a Comprehensive Risk Control and Management System, which obtained the ISO by AENOR in December 2005.