Despite all the talk about risk management, a recent surveysuggests that few companies are satisfied with their efforts, withjust one out of 10 executives describing their company's riskmanagement programs as “highly effective.” Other results of thesurvey of more than 1,400 global executives, conducted by HarvardBusiness Review Analytical Services for Zurich Financial Services,indicate that one key to successful risk management is having asingle executive, like a chief risk officer, in charge.

“Risk management needs to have an effective owner,” says MikeKerner, CEO of Zurich Global Corporate North America. “There needto be really clear roles and responsibilities. If multiple peopleare responsible for something, nobody is responsible.”

According to the Zurich study, companies are more likely to doadvance planning for many different types of risk if they have achief risk officer (CRO) or other C-suite executive leading riskmanagement than are companies with no one in charge. For example,55% of companies with a CRO have plans in place for dealing withinformation security risks, vs. 39% of companies where another execheads risk management and just 36% of those with no executive incharge. Sixty percent of companies with CROs have done businesscontinuity planning, vs. 51% of companies with another executive incharge of risk and 47% of companies with no single executive incharge of risk.

Chief risk officers are becoming increasingly common at largecompanies. According to the survey, 42% of companies with 10,000 ormore employees have a CRO, up from just 11% in 2008. The existenceof a CRO drops to 28% among companies with 1,000 to 9,999employees. But 26% of executives from companies of all sizes saythat they put a single person in charge of risk management inthe last three years.

He notes, though, that risk management can't be solely theprovince of top executives, but also requires the involvement of acompany's line managers. “They see the risks more clearly, they'remore able to do something about them,” Kerner says, adding, “It'snot just enough to report up on the risk—you need to do somethingabout it, you need to drive resources to dealing with thoserisks.”

When asked which risks have become more significant over thelast three years, 89% of executives cited natural disasters and 60%the slow pace of the economic recovery. When it comes to strategicand people risks, 55% cited talent retention and acquisition as arisk that has grown in importance, while 50% said the reputation ofthe company or brand, and 49% business continuity planning.