The purpose of this study is to conduct an in-depth analysis of the existing risk management framework (RMF) to find out the shortcomings in each phase of risk management process and risk governance issues in the commercial banking industry of Pakistan. A qualitative research design was adopted for this study to carry out the indepth evaluation of the existing RMF. A case study based research strategy was adopted in which in-depth interviews were conducted from the CROs/Heads of Risk, Head of Market, Head of Credit Risk of commercial banks of Pakistan as well as from SBP employees of RMD and BPRD division. Data was collected at one point of time so this was a cross sectional study. Data analysis was done using a technique called thematic analysis using QSR-Nvivo 11. In thematic analysis, the data collected through interviews were coded under relevant nodes. Then themes are extracted from the nodes using word cloud and word trees. The thematic analysis reveals that there are certain deficiencies in the existing RMF. Firstly, ineffectiveness of board risk oversight is due to absence of risk expert on the BRMC, lack of risk knowledge and experience, quality, quantity and timeliness of risk information, and dysfunctional behavior of executive management. Secondly, incorrect positioning of CRO is due to lack of peer status, reporting line, sole responsible of risk management, and limited to compliance function only. Thirdly, lack of maturity of risk management capabilities is due to lack of certified risk talent and risk trainings; lack of advanced e-risk solution, unavailability of tested and validated risk models, and repeatable or define state of maturity. Fourthly, weak risk culture and lack of risk awareness towards risk policy for effective risk understanding; risk identification framework for effective risk identification; e-risk software solutions; advanced risk techniques and tested risk models for effective risk assessment & analysis; inefficient information & reporting system for effective risk monitoring & controlling. Lastly, there is a lack of risk training, workshops and seminars a on the part of SBP to facilitate banks in the adoption of latest regulations and techniques such Basel III etc. It is recommended that the SBP should increase their risk training programs so that the adoption of new risk standards like Basel III will become smooth. Moreover, it is suggested that the Board of Directors (BoDs) and executive management take steps to improve the capability and maturity of the risk management function by introducing tested and validated risk models, risk certification e.g. FRM etc., advanced e-risk software solutions e.g. SAS etc., and internal risk trainings, workshops and seminars. These initiatives will improve the strength, capability and maturity of the risk management function and makes the banks more secure and profitable. Furthermore, it is suggested that the BoDs design policies to create a risk culture in the bank so that every person in the bank will understand the importance of risk management that could lead to correct the positioning of CROs in the banks so that the CROs can play their part in the most effective way. This study is the first one to apply the thematic analysis on the qualitative data in the risk management area. Previous studies do not cover the risk management framework and risk governance problems whereas the present study consider the indepth evaluation of the existing risk management framework in commercial banking industry of Pakistan and the results are beneficial for many stakeholders such as SBP, BoDs, BRMC, ERMCs and CROs.