The next phases of my dissertation is to start polling people.
First; my colleagues in the management team at the service organization where I'm working on everything I dragged them through in the sprawling initiative to overhaul processes in preparation (and response to) our annual audits of internal controls.
Then; some of my counterparts at other service organizations like ours.
I think I've figured out how to draw some pretty straight lines between the enterprise risk management function and what Michael Porter calls "Strategy". I'm not sure if this is old hat, but I'm learning, and enjoying it thoroughly