Establish and maintain an organizational policy for planning and performing the risk management process.
Elaboration:
This policy establishes organizational expectations for defining a risk management strategy and identifying, analyzing, and mitigating risks.