(14)For the purposes of the provisions of this Directive requiring an investment firm to establish, implement and maintain an adequate risk management policy, the risks relating to the firm's activities, processes and systems should include the risks associated with the outsourcing of critical or important functions or of investment services or activities. Such risks should include those associated with the firm's relationship with the service provider, and the potential risks posed where the outsourced activities of multiple investment firms or other regulated entities are concentrated within a limited number of service providers.