Can't Enterprise Risk Management guarantee against failure?
It's like asking why there are still fires now that we've hired firefighters. ERM could use a good portion of expectation management. If someone believes that nothing could ever go wrong since we have an ERM function, they need a reality check.
Not all existing risk will be discovered.
Not all discovered risk will be mitigated.
Not all mitigated risk will be eliminated.
Be sure to equip your firefighters but don't go expecting miracles.
Read more about Risk Management Failures at Sonia Jaspal's RiskBoard.