(36)For the purposes of requiring an investment firm to establish, implement and maintain an adequate risk management policy, the risks relating to the firm's activities, processes and systems should include the risks associated with the outsourcing of critical or important functions. Those risks should include those associated with the firm's relationship with the service provider, and the potential risks posed where the outsourced functions of multiple investment firms or other regulated entities are concentrated within a limited number of service providers.