What does fair rely on to build the risk management framework that is unlike many other risk management frameworks?