In his final blog for the IIA, Norman Marks argues it is time to replace audit universes with risk universes.
Surveys say enterprise risk management is a struggle for everyone. Maybe that is because many of us are doing it wrong.
The best risk is not the same as the least risk. Or, as Norman Marks might put it, risk should be managed within the context of our objectives.
Though retired, Norman Marks continues to give dependable advice about audit, governance and risk management.