Process - identification, assessment, control and mitigation

The organisation has a process by which it can identify, assess and mitigate the significant risks to the achievement of its business objectives