In all cases, risk management should be based on information that periodically and systematically portrays risks and allows, through e� ective controls, them to be minimized when possible, or at least kept stable.