“a framework for risk management”