Risk management can add value through the continuous questioning of existing controls, strategies, and scenarios. The article outlines a new framework for risk management predicated on the notion of organizational learning, and illustrates it by a case study of a company that combined the strengths of a tripartite risk management function, deploying both independent and embedded risk managers.