Interesting post here from Mr. Jez Humble on risk management in regards to IT:

http://continuousdelivery.com/2013/08/risk-management-theatre/

He lays out a comparison of what he calls “Adaptive risk management” vs. “Risk management theatre”. Perhaps these ideas could make the difference between an IT organization that effectively manages change and risk vs. one that tries to prevent both.