12.1.4 Acquire and manage the resources, including financial resources, necessary to conduct an effective risk management program.
12.1.5 Make determination on acceptance of residual risk.
12.1.6 Ensure that appropriate changes and improvement actions are implemented as required.