Article 12 6.

For each category of obliged entity referred to in paragraph 4, the assessment of residual risk in the assessment methodology shall include benchmarks for the assessment of the quality of internal policies, controls and procedures put in place by obliged entities to mitigate their inherent risk.