I think you need to have both. Risk management should be taken into consideration the entire process, but the final approval should be done by different people in risk management. This makes me think of quality teams. They are involved…   Read more»