Once we identify risks, they are brought to the attention of the relevant business segments to determine whether to accept, transfer or mitigate risks; develop mitigation plans as needed; and carry out regular monitoring and reporting.