Just ask any regulator or read any global framework for an effective program and they all start with effective and ongoing risk assessment initiatives. Everything should be based on – and will ...