Whilst looking at the various parties that have an opinion on risk in financial institutions, it is clear that many rules are in place to control these risks. However, in many cases these rules consider only one aspect of a financial institution. In contrast, risk frameworks look at financial institutions, or even systems, as a whole and try to manage all of these risks in a consistent manner. There are three broad types of risk framework:

• mandatory;

• advisory;

• proprietary.

Mandatory risk frameworks must be followed in order for an organization to carry out some types of business. However, they often have features that are useful to a wider range of institutions. Advisory risk frameworks offer guidelines for firms wishing to set up their own risk management framework. These are usually generic, which means that they can be used for a many different types of organisation, but also that a considerable amount of work must be carried out to tailor them to specific institutions. Finally, there are proprietary risk frameworks. These are frameworks used by firms for some specific purpose, the most common of which is credit rating.

All of the risk frameworks covered here are comprehensive, covering a range of risk types for an organisation. This is what differentiates a framework from a more narrowly focussed code.