For something called Governance, Risk, and Compliance, the industry spends most of its energy on compliance. Risk is the reason these programs exist, yet it remains the hardest thing to define, measure, and operationalize. Most organizations have risk registers, risk assessments, and risk scores, and still cannot confidently answer the simplest question their board will…
