Effective risk management must include a strategic element as well as an operational element.  The strategic element includes, among other things, effective governance based on a comprehensive risk policy that provides specific guidance about the organization's risk appetite