Companies struggle to build an enterprise-wide view of threats and this makes it difficult to plan strategically. Many companies do not perform bottom-up risk assessments or develop risk appetite statements. Self-assessments by the business units are lacking. Companies are increasing their investment in risk management and believe that technology can help, especially in breaking down the barriers between the risk and control oversight functions. But measuring the value of those investments remains a perennial challenge.