Hmmm, OK I'm neither a CEO or board member and I have seen all the risk assessments that I, as an employee, would be affected by when I worked in Australia.
Maybe that is the difference between Europe and Australia, the US is the openness of these plans and the use of the work face person to develop them and analyse the risks and ascertain if the contreols are viable and workable.