Risk Management Policy and Internal Control Framework