verifies the operation and suitability of the ICRM system and, in particular, checks that Management has identified the main risks, that the risks were consistently assessed and that the mitigating actions have been defined and implemented.