Although the Corporation’s organizational chart states that there should be a Risk Management Department, it has not yet been staffed because of lack of suitable staff, coupled with restrictions on new hires.