Both the risk policy and the general procedure for comprehensive risk management and control are based on the integrated framework of business management set out in the report COSO II (Committee of Sponsoring Organisations).