The comprehensive risk control and management policy and procedure defines the different duties and responsibilities of the governance bodies and those of each of the organisational units, and establishes the flow of information within the organisation and of the activities to be undertaken by the various units and bodies.