Article 21 3.

Member States shall ensure that IORPs establish and apply written policies in relation to risk management, internal audit and, where relevant, actuarial and outsourced activities. Those written policies shall be subject to prior approval by the management or supervisory body of the IORP and shall be reviewed at least every three years and adapted in view of any significant change in the system or area concerned.