COSO’s 2026 release says the same: risk management programs do not need to be perfect, just effective.
A program that fits the calendar is a program that gets used.