In order to implement risk management, non bank financial institution shall have guidelines for the implementation of risk management and obliged to conduct an evaluation of the guidelines for the implementation of risk management at least once every two years or if there are significant changes in risk.