A risk policy outlines the risk management framework an organization in relationship to its objectives, and varies across and within industries and firm based on the ability to absorb losses and the rate of return it seeks from operations.