IIA Exam IIA-CIA-Part2 Topic 7 Question 81 Discussion

An audit observation states the following:

"Despite the rules of the organization there is no approved credit risk management policy in the subsidiary. The subsidiary is concluding contacts with clients who have very high credit ratings. The internal audit team tested 50 contacts and 17 showed clients with a poor credit history"

Which of the following components are missing in the observation?