Risk management policy requires a concise document, describing the basic principles of risk management within a company and signed by its general director. Usually, it's a very short document which can be placed in an area accessible to all company employees.