What is the ever-present weakness of all risk assessment frameworks?

It requires significant use of judgment; you dont know what you dont know.

There are just too many risks to be able to cover them all.

Clients often do not want to admit they have problems, and this impairs the ability of an auditor to accurately assess risk.

You can never fully get rid of risk, no matter how good your internal controls are.