From 2004 (Integrated Prudential Sourcebook) firms must have written policies setting out the risks that they face and their strategy for managing and controlling those risks. As a minimum they will need clear policies to cover credit, market, liquidity, operational and group risk and, for insurers, specific risks relating to underwriting, claims provision and claims management. The policies must be endorsed and monitored by the firm’s managing body, e.g. the board.