Management must determine the appropriate risk management framework and be fully committed to its successful implementation. If viewed as just another senior management initiative then much could be lost both in terms of potential financial losses and good management practice.

Not having a designated risk management owner at the senior level in each business unit. There has to be ownership within the organization at senior management level with clearly defined roles and responsibilities for risk management.

Consider how best to embed risk management for the long-term from the outset. Don't skimp on training but also consider alternatives such as promoting self-study: identify and encourage those from within the business who are enthusiastic about the process.

Don't neglect the monitoring mechanisms. Every time you identify risks, there must be an associated acctions either to mitigate (or in some circumstances, accept) those plans. However, someone has to monitor the action plans and report to management and company governance.