Both the risk policy and the general procedure for integral risk management and control are based within the integrated framework of business manage ment included in the reportCOSO II (Committee of sponsoring organisations).