1. An apparatus for active policy enforcement for an enterprise in communication with a network, comprising: a policy and rules engine configured for following a pre-defined workflow for manual as well as automated completion of tasks of the enterprise; a controls and risk repository for storing content related to regulations, standards and best-practice frameworks, wherein said content are accessible by users for updating and customizing to the enterprise's needs; a risk engine configured for managing risk of said controls and risk repository and with said policy and rules engine; and an alert access subsystem configured for: providing continuous rules-driven and policy-compliant user access management and provisioning across the enterprise, using said policy and rules engine; analyzing risk across one or more information technology (IT) applications, physical systems, the network, and operational systems using said risk engine; wherein said providing continuous rules-driven and policy-compliant user access management and provisioning comprises using existing Segregation of Duties (SoD) engines for Enterprise Resource Planning (ERP) applications; and providing an enterprise view for access control exposure across the enterprise.