The risk management function must have access to all business lines that have the potential to generate material risk to the Conventional bank licensee as well as to relevant risk-bearing subsidiaries.