(c) its arrangements for implementing and reviewing the effectiveness of the policies and procedures referred to in paragraphs (a) and (b).