A newly appointed CRISC-certified risk manager finds that the organization's risk management activities are performed as a standalone annual exercise, disconnected from how business units actually design and execute their day-to-day processes. As a result, controls identified during the annual assessment are rarely implemented, and emerging risks go unnoticed until they materialize. Which action would BEST improve the effectiveness of risk management in this environment?