The key word is prioritize. With ERM, we identify and assess risks, but only so we can use the data to prioritize on a portfolio basis where we should spend or not spend our limited resources. There is a cost of action and a cost of inaction and ERM helps us make intelligent and informed choices.
Unfortunately, organizations and people often make decisions about the risks they are going to treat without data, spending too much money on the wrong things and not enough on the right things.
Prioritize.