Despite that, almost half of all organizations in the survey have no ERM processes in place,
which is surprising given that nearly 60% of organizations describe their risk culture as
“strongly risk averse” or “risk averse” and over two-thirds of organizations surveyed have
faced significant operational surprises.