The firm drafts or upgrades the full set of written policies: risk management, internal control, internal audit, outsourcing, remuneration, fitness and propriety, ORSA, data quality, investments and asset-liability management, business continuity, conflicts of interest, public disclosure and supervisory reporting.
The method starts from existing practices, gathered through interviews, so as not to impose procedures that nobody will apply; each policy names an owner, a review frequency and the indicators the board will receive.