­Traditionally, good corporate risk management has meant lots of study, careful analysis, and the flawless execution of well-honed implementation plans. A heavy focus on business optimization and continuous improvement was eminently sensible. Until it wasn’t.