Norman:
The risks you list above are relevant and have killed more than a few good companies  but I believe that a key step to focusing in on "risks that matter" is to ensure there is a universe of prioritized end result business objectives that include the organization's key strategic objectives, as well as core/foundation objectives including obeying laws and reliable financial disclosures.  Internal auditors need to focus far more time to assessing their organization's strategic planning and monitoring processes.  Unfortunately COSO 1992 does not see defining and communicating objectives as an element of an integrated control framework. This was reaffirmed in COSO 2012 ED.  

Identification and evaluation of risks should be about determining a composite estimate of the uncertainty of achieving objectives being assessed.  Attempts should be made to determine the "impact" of not achieving the objective(s) being assessed in whole or part not just fixate on individual risks without linkage to related end result business objectivess.  Objectives with high negative impact if not achieved that also have with high composite uncertainty/residual risk should receive the most attention from senior executives and internal auditors.

The dangers of "risk-centric" ERM approaches that divorce risks from end result business objectives are outlined in my white paper THE HIGH COST OF ERM HERD MENTALITY at http://bit.ly/H0MGVw

Norman:

Yes I do believe internal auditors should assess and report on the effectiveness of the organization's process to define and communicate objectives.  This is one of four categories in the Canadian CoCo integrated control framework. In some companies they haven't even communicated and assigned accountability for specific reliability objectives related to financial accounting statements and note disclosures.  Under COSO 92 this would not be considered a control deficiency.

Under the RiskStatusline system we promote any Residual Risk Status rating greater than 0 indicates unacceptable residual risk status.  There also may be situations where residual risk status is rated as 0 but still constitutes a high level or residual risk. These situations should be concensus agreed with senior management and the organization's board of directors to ensure it is within the organization's risk appetite/tolerance.

Risk as a concept and as an issue of practical risk management is implicitly linked to objectives. These need to be clearly articulated and communicated throughout the firm. If not, there is no context in which risk management can take place.

Norman is right that the really big tisk issues are concerned with gocvernance, behaviours and culture. However, as I think more about risk (in my case oeprational risk in its broadest sense), I wonder whether we should also use risk connectedness maps to identify truly important risks. That way you get back to cause which is the fundamental thing we are managing.

But back to culture. The key is to define precisely what you mean by excellent and, for that matter, inapopropriate behaviours and trhe grades in between.  A number of firms are doing this across the spectrum of their 'people' related risks.  That way you can weriously and objectively link pay wioth behavioural performance as well as finanical performance.

In a speech to the IIA in Scotland last year, I picked up on Lord Young's speech and his theme that audit could be the 'canary in the mineshaft'.  I happen to be fairly hard-line about confining audit to process, but if behaviours were properly identified by the firm, then I wonder whether it might be a legitimate role for audit to ensure that the behavioural assessment process is fair and consitent? It's a theme I'm going to put to a seminar I'm running for the Institute in Oslo later this month.

I share your opinion about these risks that reflect the reality of many corporates but generally we don't identifiy such risks because it is a matter of the top management that must be the role model in ethics, trust, accuracy, integrity, etc. and it is the most important components of internal control : "environmental control" thas directed by the Board of Directors.

In my opinion, there are risks which an audit can identify as they are measurable, whilst others can only be "sensed". These are risks, to be identifed by e.g. market research following an impact assessment request to the relevant managers asking for comprehensive and clear response strategies. In general, managing risk appropiately requires a clearly defined governance structure that forces workflows to be triggered (risks or issues identified) across the organization departments, regardless of the matter, to finalizing with a response paper that has been completed by all departments including a cross-functional impact assessment. In order to adress your executive Management operational risk identification there are many ways of enforcing processes, whilst asking your employees of all levels to submitting their thoughts and ideas about any possible element of risk (e.g. as a Sharepoint dropdown workflow adressing risks like "how is the company seen by your friends" or "what would you change here", and sending these to a central Team of experts to analyse input and possible impact, providing solution proposals (via their teams). It will show interesting results, as the tickets coming in through will not be as much in numbers but the content will be and that will enable a better definition of new strategies to be launched. The other problem you already adressed is malfunctional executives for various reasons. That can only be resolved with a direct conversation and immediate decision taking of re-arrangement of responsibilities if needed. In summary, yes, such risks have to be identified and adressed. How you do it best according to your companies profile, is the question and that most probably needs someone from the outside to identify the weaknesses an insider might overlook. It is a matter of making the company one team.