Internal & External policy regarding Risk management