traditionally risks were controlled departmentally, but now they are assessed for ______ risk exposure to the organization as a whole