Any research at all about the success of an enterprise riskmanagement program, or any risk management program for that matter,points to the need for the chief executive's support.

Without that, the risk manager has little chance of implementinga program with any impact to speak of. And without the blessing ofthe C-level, most safety or other programs a risk manager tries toimplement will be shelved by department managers who are too oftenunderfunded and understaffed.

I was reminded of this fact when reading a white paper byAllianz, titled “Preventing Water Damage: What Risk andConstruction Project Managers Need to Know.”

To create a best practices program to prevent and mitigate waterdamage, this item tops the list, according to Allianz:

“General program measures must be instituted at the corporatelevel to create a culture of risk management and continuousimprovement, as well as to provide a planning and responsestructure that is easy and cost-effective to implement with any newproject.”

According to the paper, the corporate-level program institutes acycle of continuous feedback and improvement, fostering a corporateculture of quality to improve project management, mitigate risksand minimize potential liabilities.

A check of the Allianz website revealed other papers in theseries. One on developing a corporate strategy for risk managementwas particularly enlightening on this subject.

The article asks, “Does your company have a comprehensivestrategy for defining and managing risk? Are you, as a riskmanager, an integral part of this strategy? How engaged is yourexecutive team in risk management decisions? Are you beingencouraged to supply senior management with regular updates andreport cards on your company's risk and its strategy?”

The answer to these questions, the article says, should be“Yes”–especially in today's volatile global marketplace. While itwould be easy to view 2008 as the year that the banks fell apart,the article says 2008 should also be remembered as “the year whenthe true value of risk management became evident.”

Indeed, who knew the BP Deepwater Horizon disaster would follow,with risk management again being targeted?

In other words, it is abundantly clear that maintaining anongoing partnership with the executive team is critical for asuccessful risk management program.

In study after study this is advocated, yet it is also reportedthat what is recommended isn't always followed through–andsometimes it is done in name only. If risk management isn'tperceived to be a priority by an organization's leaders, theprogram won't receive needed support.

Unfortunately, ignoring risk management best practices leaves anorganization vulnerable and can drive up insurance costs–such asworkers' compensation–if a company's employee accident rates arehigh.

Even in this soft market, risk managers tell me their safetyplans, leading to low accident rates, are keeping insurance costsdown.

Bottom line, for a successful program, all roads lead to theCEO. This makes me ask why, in case after case, corporate CEOs whenquestioned appear to know nothing about the goings-on in theircompanies. The most recent example is BP. Others include Enron,WorldCom and Delphi.

While I can't really call their previous risk management effortssuccessful, the level of the former BP CEO's ignorance of thecompany's inner workings was astonishing. In fact, BP's new plancalls for risk management to report directly to the CEO. Obviouslyits new management knows what wasn't working and why. Time willtell how it all works out.