A Recognised Body must establish a robust operational risk management framework with appropriate systems and controls to identify, monitor and manage operational risks that key participants, other Recognised Bodies, service providers (including outsourcees) and utility providers might pose to itself