Managing risk involves actions beyond establishing and communicating policies and procedures at a high level.
As organizations have set about to institute compliance programs they have learned they must come up with new methods for maintaining that compliance.