It's one thing to have solid enterprise risk management practices, but quite another to articulate their value to the greater organization.