I’m missing something. By “risk management language” do you mean simply listing risks?
I would think it would be precisely about exposing both risks and the tradeoffs involved in mitigation. If not, I don’t know what they’re doing but I don’t see how they’re managing anything.