Risk management framework and policy statement