What arguments or objections might you expect to receive from the executive level on the importance of managing security risk in a department that has transparency, independence, authority, and properly defined scope? How would you counter these?