What are a reporting entity’s obligations with regard to risk mitigation?

Updated