As a result of the above activity, a level of risk (high, medium, low) is assigned to each third party that, consequently, is subjected to an approval procedure responsive to the identified risks Additionally, the due diligence work must be repeated every 1, 3 or 5 years, depending on the level of risk identified.