Policies and procedures are established and implemented to help ensure that risk responses are effectively carried out.

Monitoring is accomplished through ongoing management activities, independent assessments, or both.