It also requires each unit to form its own crisis management organisation and, commensurate with its business operations and risk profile, to put in place policies and procedures to prevent, identify, asses, and manage crises.