My latest @ISACA post talks about how there is a lack of parallelism in the way that organizations apply Risk Treatment. In short, the lower in the organization you are the less real options that you have. You can read the article here