A good number of years ago, when companies were trying their best to cope with the impositions of Sarbanes-Oxley (SOX), I frequently heard the complaint that the bulk of compliance and risk management workload lay on the shoulders of a few central peop…