When integrating security risk management into an organization it is MOST important to ensure:

While following an established framework is a good practice for robustness, without business unit approval, even a well-structured methodology may not be effectively adopted or applied.

Business unit approval of the risk management methodology ensures that the approach is practical, relevant to their operations, and integrated into their decision-making processes, leading to greater adoption and effectiveness across the organization. Without business unit buy-in, even a technically sound methodology may fail to be effectively implemented.

Defining the risk treatment process is a crucial component of risk management, but it is a tactical detail that stems from an approved and integrated methodology.

Documenting and understanding information security policies are fundamental, but policies are part of the overall security program that risk management informs and supports; their existence alone doesn't ensure integrated risk management.