(23)Directive 2009/65/EC contains an obligation to specify the criteria for assessing the adequacy of a management company’s risk management process. Such criteria focus on the establishment of an adequate and documented risk management policy to be employed by management companies. This policy should enable the management companies to assess the risks of the positions taken within the portfolios they manage and the contributions of these individual risks to the overall risk profile of the portfolio. The organisation of the risk management policy should be adequate and proportionate to the nature, scale and complexity of the management company’s activities and of the UCITS it manages.