I don't want to be nitpicky about this, but I have one more question before I leave it.
You talked about how much planning has to be put in place before you put in a system like that. Again, since risk management is so important, I'm having trouble understanding how you failed to put in place what would seem to be an obvious part of any new risk management process. Was it just bad management, bad planning? What was it?