Annexes (p. 40-55): 1. Benchmarks and recommendations from the previous Joint Inspection Unit report on enterprise risk management -- 2. Status of policy and/or framework and organizational structure for enterprise risk management -- 3. Oversight by legislative/governing bodies and audit and oversight committees -- 4. List of informal recommendations -- 5. Overview of actions to be taken by participating organizations on the recommendations of the Joint Inspection Unit.