frameworks are just that: guidance that is flexible, scalable, and proportionate to the objectives and structure of the organization. To be clear, risk management frameworks may overlap with, but are never a substitute for, the standards of quality control for a CPA firm's accounting and audit practice, as well as the governance and reporting practices more generally. Even with robust risk management systems and a strong commitment to quality control standards, certain risks will materialize and mitigation and remediation become essential. It's in those circumstances that governance and reporting is even more critical