A client has a major non-conforamnce identified during an external audit. The major con-conformance was that the organisation did not show sufficient evidence that it has identified its risk, and controlled them. Your mission is to create a system that the organisation can integrate into its business as usual activities that would demonstrate this in the future. What is your plan?