ESRM The Holy Grail or a concept found wanting?

There can be few concepts or frameworks that have received so much coverage as ESRM. It draws upon a range of established good practices and is sometimes presented as an unqualified good bringing together the best learnings from many approaches to security. Yet, not all organisations adopt it. After all, the concept of the business owning the risk appears good, but at what point does that go too far? Does ESRM really amount to security ‘passing the buck’, isn’t security supposed to be in char...