The Securities and Exchange Commission saddled companies with a new chore late last year when it announced regulations requiring them to disclose risks associated with compensation plans in their proxies. The timing of the announcement gave calendar-year companies just a few months to put together the disclosures. And the process could push some companies into new territory, since risk hasn't been high on the list of considerations when they put together pay plans.

"I just have not run into anyone yet who says they do a thorough assessment of compensation policies and practices as they relate to risk exposure," says Mat Allen, who leads the ERM services and solutions practice at Marsh Risk Consulting.

While companies already disclose details of the compensation they provide to their top executives, "now we're talking about disclosure of risk relative to compensation for every employee," says Allen. "As a general rule, publicly traded companies don't spend a lot of time analyzing risk relative to broad and specific compensation policies."