Companies face many risks as they operate. Most of these risks can be, and are, identified and dealt with by the Risk Management department of a company. What should the ERM program say about 'novel' risks that exist but may not have been identified? What should be in place to provide for the necessary flexibility to address these 'novel' risks that present themselves?