Hence, for this reason, companies are required to put in place procedures for the evaluation of risks that are consistent with not only their size and structure, but their nature, scope and place of business.