If a risk owner refuses all your security risk mitigation recommendations, and they have the appropriate authority to do so, then in the ESRM philosophy, you have successfully completed your role. How does that differ with the traditional security role?