I would have thought that if the entire organisation has a "risk-management" mentality, then it will be very hard for new and break-through initiatives to occur from within.

I don't mean to imply that risk-management is unimportant - just the opposite - it is critical. However, it depends on where the risk management should occur. If you are an engineering company making or designing highly volatile and dangerous products, then product and process risk-management disciplines need to be embedded within the company, while the business risk-management needs to be(inevitably will be) "higher-up".

On the other hand, if you are in a highly volatile consumer market that requires adaptive products and innovative channels, you need to be creative and encourage creativity within the departments of the corporation. The commercial (and legal) risk management activities need to occur at executive management and at board level.

Horses for course, as they say. What is certain however, is that one size does not fit all. Be careful what you aspire to achieve - a risk management culture throughout will stifle entrepreneurship and creativity - just look at the Australian banks!