Section 404 of the Sarbanes-Oxley Act proved to be an arduous process for many public companies, yet these requirements cover only a slice of the total risks facing businesses. A much wider range of factors − including strategic, operations, and compliance risks − lies outside of the financial reporting and internal controls areas of Section 404. Any of the wide spectrum of business ri…