Confused about Frameworks?

Because the success of risk management will depend on the effectiveness of the framework, this is a topic that we do not take lightly during training. The confusion stems from the misunderstanding of the word 'framework.' It is not a document needing creation, or something to acquire.

A framework is defined as a real or (in this case) conceptual structure intended to serve as a support or guide for the construction of something more, i.e. expanding the structure into something useful. When an organization wants to manage risk consistantly and effectively, it must first ensure that the organization has nine essential management capabilities in place.

The standard refers to these capabilities as 3 foundations and 6 organizational arrangements.