The comprehensive risk management and control policy and procedure define the different duties and responsibilities of the governing bodies and those of each of the organisational units, as well as establishing the flow of information within the organisation and the activities to be undertaken by the various units and bodies.