Has the board established a clear and internally consistent risk management policy, including risk limits?