Risk and Information System Control Framework in business includes the methods and processes to manage risks and seize opportunities that involves identifying particular risk events relevant to the objectives, assessing them in terms of likelihood and magnitude of impact, determining a response strategy, and monitoring progress. In order to achieve better support for the backtracking, traceability, irreversibility, and credible requirements of risk registration table data in the framework, this paper proposes a blockchain-based risk and information system control framework. A risk association tree is designed for combining summarized risk item ledgers with risk assessment ledgers and risk response ledgers based on the Merkle Tree. Three proposed smart contracts are used in risk identification, risk assessment, risk response and mitigation, and risk and control monitoring and reporting processes. We implement a prototype for this framework.