Why processes don’t work, at all: The blocks. The activities scheduled, often only throughout the year, in sequence. As if … Reality will throw all activities at you every day, as reactions to incidents and panics.
Along the lines of “Can’t have a massive data breach today, because this first quarter we’re only supposed to do risk analysis by the book – unsure if by Summer, we’ll have finished this as everyone is learning the first baby steps of it in turns. Come back per September and we’ll have a result that no-one of us recognises, or anyone else for that matter, as anything approaching a serious result, and no-one will know what to do next or have budget for it.” (Remember, the 15.5 risk ..?)
Practice may sober you up. Then, auditors come around. “Check. We did ask about this. Uncheck. You failed to do the irrelevant. It’s nothing personal, but your head will roll.”
Oh well, Mintzberg had it right already.