We have to move on from this 3-lines-thinking, it is outdated, every employee is a risk manager and must manage the risks associated with his or her job on a daily basis, in an effective Risk Culture there is no need to "defend" it is just optimised risk management and taking more risk to get more reward and build sustainable competitive advantage. Those who are not good or do nothing to build an effective Risk Culture, will just be exploited by those who are better.
Comments