1. Competent authorities shall review, to the extent relevant and necessary, taking into account the investment firm's size, risk profile and business model, the arrangements, strategies, processes and mechanisms implemented by investment firms to comply with this Directive and with Regulation (EU) 2019/2033 and evaluate the following as appropriate and relevant, so as to ensure a sound management and coverage of their risks:
(a) the risks referred to in Article 29;
(b) the geographical location of an investment firm's exposures;
(c) the business model of the investment firm;
(d) the assessment of systemic risk, taking into account the identification and measurement of systemic risk under Article 23 of Regulation (EU) No 1093/2010 or recommendations of the ESRB;
(e) the risks posed to the security of investment firms' network and information systems to ensure confidentiality, integrity and availability of their processes, data and assets;
(f) the exposure of investment firms to the int
…