Principle 10 (CI-2.2.3) requires firms to have systems and controls that are appropriate for their business. Consequently, Module RM (Risk Management) contains Rules and Guidance on how, specifically, firms should monitor and manage risk. This Module applies to all licensees, and it is for firms to consider the scale and complexity of the procedures that are required, given the nature of their operations.