Most organizations believe the risk is gone once documentation is completed. The policy is written. The procedure is approved. The file is archived. But what really happens the day after...