A framework is usually generalized and more easily understood by many in the organization instead of just a few. The COSO Internal Control - Integrated Framework is an excellent example of a framework's wide appeal and applicability. Several authoritative bodies have now offered their views on risk management. The Canadian Standards Board followed in 1998, and several other countries are considering similar standards. These and other recent attempts by others have helped us to develop a better sense about risk management, but none of them offer the kind of integrated framework needed to understand risk.
Most people have an intuitive understanding of risk based on their common sense and experience.
Perhaps it is this common-sense approach that lulls us into false comfort. Obvious risks are no real threat, given a reasonably alert management. However, it is unintended consequences that challenge our common sense and experience. An integrated framework of risk ensures that the blended knowledge and experience from our collaborative efforts can be organized and communicated to top management in a language that all understand. Such a framework needs to be both complete and flexible so that it adapts to all types of organizations.