Every organization with a GRC program has a risk framework. Most of them are not actually using it. The difference between a framework that drives decisions and one that collects dust comes down to a few very specific design choices.