ERM practices are often synthesized by a standardized risk report delivered to upper management ... must detract the time of its staff and may make capital investments to implement ERM strategies.