VW believed they had a comprehensive, holistic approach to risk management that followed best practice. Their scandal shows that naughty little bits of software pose a risk to any business.