(13)The SST also requires (re)insurance undertakings and groups to maintain risk-management, compliance, internal audit and actuarial functions. The SST imposes a risk management system capable of identifying, measuring, monitoring, managing and reporting risks, and an effective internal control system. The requirements of Directive 2009/138/EC regarding internal audit and compliance for solo undertakings are satisfactorily addressed by the ISO, since it reinforces risk management requirements and in particular the obligation to have a compliance function.