Identify the company’s existing (if any) risk management policies. Evaluate these policies and assess whether these may or may not be effective. For policies identified as less effective, propose alternatives that make sense given the company’s existing structure