If most midsize companies have a formal risk management process, why did so many fail even in pre-pandemic years? The problem is that risk heat maps — many companies’ primary tool for assessing risk — have fatal deficiencies.