This is a failure of management to understand the business
Whoever was reading these reports and seeing the risk exposure change regularly by large amounts (depending on what was the last position evaluated) should have known something was up.
They should have also known something was up the first time they used this tool, based on "wow we have all this risk but our total exposure is that low?"
The worst thing is if management used it as a guide of "we have room for more risk" they would have just kept piling on risk after risk, and never come close to their threshold. They surely should have known something was up then!
Biting the hand that feeds IT
