are determining and assessing risks, developing and implementing risk mitigation activities, reporting on the results of risk manage ment, and evaluating the effectiveness of the risk management system.