Paul J. Sobel was approaching a crossroads in his long career when Georgia-Pacific Corp came calling to ask him to serve as its chief audit executive. Sobel previously performed the same role at three other public companies—two in the energy business and one in publishing—and before that was a partner at the late accounting firm Arthur Andersen, leaving just prior to its collapse. “I really knew very little about the paper, pulp and building products industry, but G-P put a great opportunity in front of me,” he explains.

The opportunity was to develop a methodology for enterprise risk management at the Atlanta-based manufacturer. Sobel is something of an ERM pioneer. He first learned about this holistic process for identifying, assessing and mitigating potential risk exposures in the 1990s at Andersen, and in 2003, wrote one of the first books on the subject from an auditor's perspective—“Auditor's Risk Management Guide: Integrating Auditing and ERM.” Sobel also implemented ERM at Mirant Corp. and Aquila, his two previous employers.

“I've always tried to approach ERM in a more practical than theoretical way, and writing the book helped me to demystify it and make it a bit more contextual and understandable,” he says. “I now think I can apply it to most types of organizations, not just banks and energy companies.”