Risk managers in organizations have long understood that, contrary to popular belief, they don’t control risk. Their challenge has always been striking the right balance between the risk an organization is exposed to and achieving its objectives. Risk management therefore cannot be divorced from the overall strategic orientation of an organization and risk management is the responsibility of everyone in the organization who makes key decisions that affect risk exposure.