All organizations face potentially crippling risks.
Events that can result in disastrous consequences range from a failure to manage risks associated with a particular strategy, to losses that arise from noncompliance with control procedures for business transactions. Additionally, systems used to control risk can become a risk for the business enterprise if the systems strangle the organization with bureaucracy, stifle employees' creativity, or impede management's ability to respond to changes in market conditions. Under this approach, risks are addressed at the level of the organization directly affected by the particular exposure. The process for managing such risks harnesses people's ability to understand and assess what is happening in the business environment. Functions must then share information so all risks are identified, and assumptions and strategic objectives are continuously challenged.