Policy risk assessment framework development