“a framework for assessing corporate governance and risk management”