Many organisations have deployed risk management programmes to identify, assess, and manage risks, using techniques such as risk assessment, scenario analysis, and stress testing as a basis for determining response strategies that align with the entity’s objectives and risk appetite and tolerance.
However, major events occur that reveal shortcomings in risk management programmes and limits to organisations’ resilience in the face of risk. Questions arise: Where was the breakdown? Why did the risk management process not work? How could we have known?