Organizations that treat IT risk management as a technology issue rather than a corporate one will leave themselves exposed to numerous problems that could threaten the health of their entire business. There's no doubt that technology support will be required. However, IT risk management is just as much an organizational issue that relies on putting the right people in the right roles with the necessary guidance.
Source: CBR Online