Policies and protocols Once the risks are identified and duly evaluated, the company must approve the required internal rules (policies, protocols or procedures) to which decisions and activities will be subject in order to prevent and mitigate said risks.