In my 34 years of experience as an internal auditor, I’ve seen a wide variety of enterprise risk management control failures. And to my thinking, they all share one common denominator: a failure by the board or the CEO to implement an effective ERM program that addressed the right risks.
