According to the directive, all divisions through to the individual companies are responsible for the implementation of a functioning risk management process (risk identification, risk assessment, risk management, reporting, monitoring/verification).