“For a successful ERM program, both qualitative and quantitative risk assessments are important. Keep an eye on emerging risks. And plan for immediate and long-term requirements”