Because risk management is everyone’s responsibility, all employees are empowered to and expected to challenge risk decisions when appropriate and to escalate their concerns when they haven’t been addressed .