Where necessary, risk mitigation programmes may be developed with a firm in order to mitigate or remove identified areas of risk.