MIR 2.5.16

In assessing a Recognised Body's systems and controls for assessing and managing risk, the Regulator may also have regard to the extent to which these systems and controls enable the Recognised Body to:

(a) identify, measure and control all the general, operational, legal and market risks wherever they arise in its activities;
(b) allocate responsibility for risk management to Persons with appropriate knowledge and expertise; and
(c) provide sufficient, reliable information to Key Individuals and, where relevant, the governing body of the Recognised Body.