The boardroom has always been the preserve of the gifted, the ambitious and the self-confident. In Anglo-Saxon business culture, board-level executives wield substantial power and, while other stakeholders have a voice, it is predominantly the views of these top few board members that count in terms of business planning and strategy.

This dominance – previously unquestioned by all but the most powerful shareholders – has recently become a matter of urgent debate. The credit crisis and subsequent global recession have exposed failings in planning and strategy that have led to loss of business, sharply reduced earnings and, in some cases, bankruptcy. While many companies have blamed extraordinary economic conditions for their difficulties, investors and other stakeholders have come to see the corporate world as part of the problem. In particular, they are examining closely whether corporate governance and the oversight of risk have been sufficiently rigorous, and whether the relationship between the board and the business has been uncomfortably cosy.

In May 2009, the Economist Intelligence Unit conducted a global survey on behalf of ACE and KPMG to explore the extent to which companies are changing their approach to risk governance in the wake of the financial crisis. The survey attracted 364 participants from a wide variety of sectors and regions. The report that follows presents the highlights of those survey findings along with related additional insights drawn from industry experts and commentators. Key findings from this research include the following:

Companies recognise the need for greater risk expertise, but there is a reluctance to recruit it in some areas. Although the majority of respondents to our survey believe that levels of risk expertise are high among senior executives in their organisation, they are less complimentary about risk awareness among non-executives and board committees, as well as among the broader business. Yet despite recognising these gaps in knowledge, the survey reveals a surprising reluctance to recruit risk expertise, particularly at the top of the organisation. More than half of respondents say that they have no plans to recruit a chief risk officer, and slightly less than half say that they do not intend to recruit a board-level executive with overall responsibility for risk management. With a high proportion of respondents saying that a "risk culture" depends on strong direction from the top of the organisation, an absence of expertise at board level suggests that many companies will find it difficult to embed a greater awareness and understanding of risk in their business.

Financial constraints are hampering necessary investments in risk management. Asked about the main barriers to effective risk governance in their business over the past year, respondents point to poor data quality and availability, lack of expertise and ineffective tools and technology as the main challenges. Yet asked about the main barriers in the year ahead, a lack of financial resources eclipses all other concerns. These expected budgetary constraints may explain why, when respondents are asked about their main priorities for risk management, they say that that intend to focus on processes, rather then data, technology, or recruitment. Process improvements generate easy, relatively inexpensive benefits but, on their own, they will not go far enough to address more fundamental risk management deficiencies. The underlying problems with data, expertise and technology, which they identified before concerns about cash rose to the fore, are likely to remain.

Compliance, controls and monitoring are consuming a disproportionate amount of time, but risk managers' real priorities lie elsewhere. Respondents to our survey point to the identification of new risks as the most important role and responsibility of risk management. But asked how they allocate their time, it is compliance, controls and monitoring that consume the lion's share of their resources. With a disproportionate amount of time being spent on the more mechanical aspects of the role, risk managers may be neglecting the responsibilities that they have identified as being most important. This trend is likely to be exacerbated by a rising compliance burden, a shortage of resources, and increasing pressure on risk functions to put in place rigorous controls.

More needs to be done to ensure that the right risk information is reaching the right people. Only around one-third of respondents think that their organisation is effective at ensuring information about risk is reaching the right people. There is also limited confidence in risk reporting: one-third again think that risk reporting is effective at providing an aggregate view of risk exposure, while only 30% think that it is effective at providing information that is tailored to its audience. Better risk reporting will depend on improved communication and understanding between risk functions and their intended audience. Only then can information be provided that is relevant, timely and pitched at an appropriate technical level.

There is a window of opportunity for chief risk officers to take on a more strategic role. It is notable that, in the majority of companies, chief risk officers play no role in major strategic initiatives: just 44% of CROs are actively involved in M&A activity, for example, and just 36% in product development. Equally, only 47% of respondents believe that their organisation is effective at linking risk with corporate strategy. Yet at a time when risk is dominating boardroom agendas, there is a rare and valuable opportunity for senior risk professionals to take a seat at the top table, and to make themselves an indispensable part of any discussion about the future of the business.