In my 34 years of experience as an internal auditor, I’ve seen a wide variety of enterprise risk management control failures. And to my thinking, they all share one common denominator: a failure by the board or the CEO to implement an effective ERM program that addressed the right risks.
That has become all the more clear in light of the financial crisis of the last 18 months, where many banks failed to understand the risks confronting them—and then just failed, period. An effective ERM program might not have prevented all these failures, but it certainly would have identified the ...