Policies: Risk management framework