Marks raises a simple but an important question.
“How does your organization manage risk?”
This is one of the kinds that you do not realize the cost of not doing this right until something terrible happens. Then the cost is much more than if it was done right in the first place.