The different responsibilities of the governing bodies and of each organisational units, as well as information flows and activities to be undertaken by the various bodies, are defined in the risk policy and specific procedures.