A risk management plan that addresses financial, physical, and human resources; infrastructure; and strategic and reputational risk is in place and reviewed regularly.  

Evidence: 

• Risk management plan 
• Description of the process used to develop and review the risk management plan, including the review schedule 
• Date the risk management plan was last reviewed by the board and the results of the review