Enterprise Risk Framework

I think COBIT is a generic framework you could use.   I don't have access to the cobit framework but it would be easily enough to take it from an excel document and import into Provision.   I would recommend using the impact object for the risk and the rule object as the control or you could create a new control object and risk object all together.