(1) Investment firms shall take the following actions:
(a) establish, implement and maintain adequate risk management policies and procedures which identify the risks relating to the firm's activities, processes and systems, and where appropriate, set the level of risk tolerated by the firm;
(b) adopt effective arrangements, processes and mechanisms to manage the risks relating to the firm's activities, processes and systems, in light of that level of risk tolerance;
(c) monitor the following:
(i) the adequacy and effectiveness of the investment firm's risk management policies and procedures;
(ii) the level of compliance by the investment firm and its relevant persons with the arrangements, processes and mechanisms adopted in accordance with subparagraph (b);
(iii) the adequacy and effectiveness of measures taken to address any deficiencies in those arrangements and procedures, including failures by the relevant persons to comply with such arrangements or follow such procedures.