“My boss tells amazing stories. I could listen to her for hours.” I was talking with an IT audit manager at a global pharma company when she made that comment.

Process owners are subject matter experts who understand processes, procedures and controls in place, whether documented or not. However, auditors usually go by the maxim that “If it’s not documented, it does not exist.”

Well-developed risk scenarios providing a realistic and practical view of risk that may prevent an enterprise from achieving its business objectives are especially valuable in today’s fast-moving and often volatile business landscape.