The idea of an integrated view of risk is well-understood in heavily regulated industries like financial services, manufacturing, and healthcare. They have long had to prove compliance with a variety of regulations unique to different departments and functional groups such as SOX in finance, privacy regulations in legal, and NIST or HIPAA in security. This has forced many of these organizations to take a broader view of managing risk, even though piecing together a consolidated report of organizational risk for auditors, executive management, or the board has been time-consuming and painful.
