What Could Be: This is the organization’s strategy and aspirations.  Risk, managed from this context provides solutions and promotes creativity and organizational unity.

What Is: This is the internal operating environment of an organization and the place where business and operational managers can have the greatest impact on managing the risks that must be embraced to achieve the strategy.

What Should Be: These are internal and external standards that are used to evaluate adherence to the basic requirements of the business and the behavior it expects from its employees.

Risk management is a dynamic process in which the perceptions of operational and business managers are converged in the context of the business strategy.