Explain the legislative and regulatory context of the organisation in relation to risk management