This is missing from most GRC and ERM programs
Norman Marks argues that most GRC and ERM programs fail because they take a bottom-up approach, identifying risks first and only later mapping them to objectives—thereby missing key strategic risks and opportunities. He emphasizes that true governance and risk management must start from enterprise objectives and strategies (a top‑down approach) to assess effectively the likelihood of achieving organizational goals.
Norman Marks argues that most GRC and ERM programs fail because they take a bottom-up approach, identifying risks first and only later mapping them to objectives—thereby missing key strategic risks and opportunities. He emphasizes that true governance and risk management must start from enterprise objectives and strategies (a top‑down approach) to assess effectively the likelihood of achieving organizational goals.
Read more
