Organizations often spend huge amounts of money and time setting up risk processes and methods, along with supporting tools and training, which often fail to deliver the expected value. Why is this so? We believe the problem isn't in the risk processes themselves, which are usually logically correct. Rather, these investments alone do not enable great risk management practice because risk management is difficult -- it relies on getting groups of people to agree on how to manage things in the future that may or may not happen.