Fall guys: Risk management in the front line is an Economist Intelligence Unit report that examines the changing role and responsibilities of risk management in business. The report is sponsored by ACE and KPMG. The Economist Intelligence Unit bears sole responsibility for the content of this report. Our editorial team executed the online survey, conducted the interviews and wrote the report. The findings and views expressed in this report do not necessarily reflect the views of the sponsor.

Risk management can be a thankless task. Just ask Paul Moore, the former head of regulatory risk at HBOS, who claimed that he was sacked because he told the bank's board that it was taking too much risk. In the wake of the financial crisis, stories that banks would sidestep risk managers in order to get deals done were legion. Risk managers with legitimate concerns about the business were ignored and regarded as a brake on growth.

Three years on, the perception of risk management has changed. In the financial services industry, there is a clear consensus that serious mistakes were made with either risk management or risk governance. In response, banks and other financial institutions are beefing up risk departments and creating new governance structures that add to the risk function's authority and independence. Boards are creating risk committees and ensuring that non-executives are providing effective oversight of the company's risk exposure. Chief risk officers are being granted powers of veto over decisions made by executive management and reporting directly into non-executive directors.

This renewed zeal for risk management extends far beyond the banking sector. Events such as the financial crisis, and more recently the oil spill in the Gulf of Mexico, have reminded senior executives that failures in risk management can prove to be extremely costly, not just to a company's financial performance, but to their own careers and, sometimes, the lives of employees. The incentive to ensure that there is a clear and consistent approach to managing risk across the enterprise has never been greater.

However, although risk management is currently enjoying an unprecedented level of authority and visibility, it remains a function in transition. Examples of companies that take a genuinely strategic approach to their risk management remain few and far between. Communication between risk functions and the broader business can sometimes be fragmented, while an enterprise-wide culture and awareness of risk can be difficult to achieve.

To assess the current state of this transition, the Economist Intelligence Unit conducted a global survey of senior executives, from both the risk function and general management. This report presents the highlights of those survey findings, along with related additional insights drawn from interviews with industry experts and commentators. Key findings from this research include:

Strategic risk management remains an immature activity in many companies.Senior executives surveyed for this report clearly recognise the importance of strategic risk management to their business. They see major strategic threats, such as weak demand and market volatility, as the biggest risks they face over the next 12 months, and regard the identification of new and emerging risks as the key goal of risk management. But they also see this aspect of risk management as among their biggest weaknesses, with just 35% saying that their company is effective at anticipating and measuring emerging risks.

Only a minority of companies involve risk functions in key business decisions. Risk managers have long hoped to play a more prominent role in strategic decision-making, but our survey suggests that this aspiration is still unfulfilled. Less than one-half of companies involve their risk functions formally in any major strategic decision, such as evaluating new market investments or M&A opportunities. Few companies even expect risk functions to play a support role in decision-making, with just 41% saying they expect risk managers to provide analysis to help management set corporate strategy.

Risk managers want to spend more time on the constructive aspects of the role.The risk function needs to spend more time on the "enabling" aspects of the role, such as helping business managers to achieve their business objectives. Survey respondents see this as the second most important objective for risk management but, at present, they do not believe that sufficient time is allocated to it. Instead, the lion's share of the risk function's attention is dedicated to "preventative" activities, such as controls and monitoring.

There is limited appetite for investment in the risk function. Despite rising to greater prominence in many companies, risk management has not generally attracted significant financial investment over the past year. Less than one-half of companies have invested in risk processes, while less than one-quarter have allocated funds to headcount or training of managers in the central risk function. Ongoing cost constraints and company-wide budget freezes are undoubtedly helping to curtail investment, but care must be taken not to compromise the effectiveness of overall risk management.

Risk functions have increased in authority, but there is a danger that this will not be a permanent change. The financial crisis has placed risk management under the spotlight. Just over one-half of the survey respondents believe that risk management has increased in authority as a result of the downturn. There are concerns, however, that this elevated position could be temporary, with a similar number of respondents agreeing that the authority of risk management will inevitably decline when the good times return.

There are doubts about the risk expertise among non-executive directors. The board plays a crucial role in setting the tone from the top and instilling a broader culture of risk awareness in the business. However, although confidence levels in the knowledge of executive management are reasonably high, many respondents worry that the technical risk knowledge of non-executive directors is lacking. Companies should pay careful attention to the composition of their boards and make sure that they have the right level of knowledge in place in order to ensure effective oversight.