Risk management is a continuous process that requires commitment, time and expense. On the other hand, the benefits are often difficult to identify because they arise largely from prevention. How can a business decide whether the benefits of a risk management plan compensate for the time and expense involved in its design and implementation?