(9)The requirements of Regulation (EU) No 648/2012 relating to internal risk reporting lines need further specification to implement a risk-management framework, which includes the structure, rights and responsibilities of the internal risk management process. Governance arrangements should take into account different regimes on corporate law in the Union, in order to ensure that CCPs operate within a sound legal framework.