Step 3: Establish a Management Risk Committee or Working Group