As part of the internal control system, risk management takes the form of taking inventory of the risks every six months and controlling and reporting them based on an overall known and acceptable risk strategy.