Article 41 3.

Insurance and reinsurance undertakings shall have written policies in relation to at least risk management, internal control, internal audit and, where relevant, outsourcing. They shall ensure that those policies are implemented.

Those written policies shall be reviewed at least annually. They shall be subject to prior approval by the administrative, management or supervisory body and be adapted in view of any significant change in the system or area concerned.