for identifying, managing and monitoring operational, financial, regulatory and compliance risks;

for recording and documenting risks in an appropriate and durable format;

for ensuring that risks are managed in a timely manner by the appropriate persons;

for informing the trustees about risks that have arisen and the steps being taken to manage them.