" policies and other requirements at least annually for both aggregate risk and" . . . .