I'm doing a business course atm and the professor has worked in risk management for a very long time. Probably the first thing she told us about risk management is how careful you have to be and how hard it is to get people to actually talk about risks for this exact reason. It's ridiculous, you'd think people would want to cover their bases. She also mentioned this is why it's almost always outsourced, so nobody in the company has to be the bad guy.