For each issue and related risk element, the following were also identified and defined: the main business processes involved, their inclusion in a specific risk assessment (at “Operational” or “Enterprise” level), inclusion in the Group Risk Policy, the presence of specific systems governing the issue.