1. Member States shall require IORPs, in a manner that is proportionate to their size and internal organisation, as well as to the size, nature, scale and complexity of their activities, to carry out and document their own-risk assessment. That risk assessment shall be performed at least every three years or without delay following any significant change in the risk profile of the IORP or of the pension schemes operated by the IORP. Where there is a significant change in the risk profile of a specific pension scheme, the risk assessment may be limited to that pension scheme.

2. Member States shall ensure that the risk assessment referred to in paragraph 1, having regard to the size and internal organisation of the IORP, as well as to the size, nature, scale and complexity of the IORP's activities, includes the following:

(a) a description of how own-risk assessment is integrated into the management process and into the decision-making processes of the IORP;

(b) an assessment of the effectiveness of the risk-management system;