You should read this revised enterprise risk management framework even if it is not very good.