"Our goal is to see it before it imperils the organization," he says. Cowperthwaite wants to prevent anything like what happened after Lehman Brothers went bankrupt and companies had no idea how much risk they faced as a result of that.

"One person can't see everything. How are we going to know what large, critical risks we are threatened by when people weren't able to see it in 2008?"

Working with Providence's chief risk officer, as well as with the heads of the audit, compliance, privacy, insurance and security departments, Cowperthwaite developed and implemented an enterprise risk management services group.

This new organization is built according to how the business actually operates and not some inherited idea of how security should be divided. "This is a vision of a group of people who feel really strongly about the need for risk management at the enterprise level," he says.

That's not to say he doesn't understand the need for specific types of expertise. "We wanted to share our knowledge," he says. "We knew it wouldn't make sense to have tech people reporting to people who just analyze risk, just as it wouldn't make sense to have people who analyze risk reporting to tech people."