An audit observation states the following: "Despite the rules of the organization, there is no approved credit risk management policy in the subsidiary. The sub...