Which of the following BEST indicates the condition of a risk management program?