BNY Interview Question

How do you apply the Risk process to IT Investments Application process. What Risk frame work would you use ?