Risk management procedures are used to identify and quantify risks, establish controls, conduct regular reviews and audits of their effectiveness, and escalate and remediate where issues and breaches occur.