Everyone talks about the need for good risk-management programs, but nobody seems to know how to audit them to ensure they actually work.

Everyone talks about the need for good risk-management programs, but nobody seems to know how to audit them to ensure they actually work.