the evaluation of controls and the management of a monitoring process, both in terms of design and operations and effectiveness, with the aim of reducing risks to a level considered “acceptable” (information flows, gap management, plan for remedial action, reporting system, etc.), based on an annual plan approved by the Internal Control Committee.