"We looked at what might happen if all shipping were halted because of a storm, and decided that we needed more storage capacity so we could ride out a shipping shutdown for two weeks," Tiah says.

"That kind of mind-set is part of what we do," says Tiah, who takes a lead role in an ERM system that he says is integral to every part, and every level of management, of Phoenix Park's operations.

In looking at what Tiah calls "historically unique, what-if type" scenarios of risk, he and Dominic Rampersad, the company's vice president of finance and information technology, are unusual, according to a recent survey of corporate ERM programs conducted by insurance brokerage Aon.

One of the survey's findings: only companies that are very experienced with ERM and have well-established ERM programs look much beyond the run-of-the-mill, more or less predictable risks they have experienced in the past to try to imagine the big, unanticipated risks. And even among those experienced firms with robust ERM programs, only some look at what former Defense Secretary Donald Rumsfeld famously referred to as the "unknown unknowns."

"Our survey found that most companies stay within their four walls in assessing risk," says Laura Taylor, global ERM practice leader at Aon.

"There's not a lot of reaching out to clients, to outside board members, or to competitors, etc., to do the what-if kind of thinking about risk," Taylor says. "But the thing is, just because it hasn't happened to you doesn't mean it won't happen." And going outside those four walls is one good way to find out what other risks are out there.

Just look at BP. Only last year, the company told government regulators that there was virtually no chance of a well blowout in its deep-sea oil drilling operations.

Earlier, BP and the rest of the oil industry had lobbied successfully against a proposed rule requiring remote sonic shut-down switches on well-head "fail-safe" blowout preventer units–something two other oil producing countries, Norway and Brazil, require on all deep-water wells, and competitors like Shell and Total install voluntarily. Yet the well being drilled by its leased Deepwater Horizon rig did blow, leading to what may be the biggest U.S. oil disaster in history, and when the control unit on the rig was destroyed in the resulting fire, there was no way to trigger the shut-down device 5,000 feet below on the ocean floor.

Accenture senior executive Bill Spinard says the picture may not be quite as grim as the Aon survey suggests when it comes to companies' assessment of major unanticipated risks.

"What we're finding," Spinard says, "is that when it comes to those blue-sky events, companies are changing the way they look at it. They don't waste time trying to assess probabilities, the way they might with more commonplace risks. What we advise, and what they are doing, is not looking for triggering events, which you won't find, but processing the end results and figuring out what you'd do if it did happen.

"That gets management focused on activities," he explains. Even the government, notes Spinard, in the case of financial companies, is saying that where it's not possible to model the probability of certain risks, they want those companies to work through scenarios for dealing with them should they strike.

As an example of planning for the unpredictable, Spinard cites the surprise volcanic eruption in Iceland this spring. Its huge plume of ash shut down all European air travel for days.

"You could never anticipate a volcano," Spinard says, "but some companies that depended upon air travel had developed alternative supply chains in the event of a surprise shutdown of air traffic."

Aon's Taylor says it's clear that many companies have a long way to go before they reach the level of a company like Phoenix Park in terms of embedding a robust ERM program. Just 7% of the companies in the survey describe their ERM programs as advanced. While that is more than double the 3% that described their programs as advanced in a 2007 survey, only a quarter of those companies say they have had success at identifying and analyzing unexpected risks.

Taylor says the good news is that fully 55% of the companies surveyed report that they have operational ERM programs, up from only 35% in the survey conducted two years earlier. "There has been significant improvement in adoption of ERM in the middle range" of sophistication and implementation of risk management, she says.

Taylor suggests this may be in large part because many companies feel no need for or see no advantage from a cost-benefit perspective in moving to a broader, or more sophisticated and costly ERM system.

"They may just not feel it is worth it to push things that far," Taylor says, although she adds, "I would say that those that do become experts and that have an advanced ERM program generally conclude that it was worth it."

Indeed, as the study concludes, "Sixty-five percent of all survey respondents report at least isolated success in using risk management to protect or enhance shareholder value, and the level of success improves considerably as organizations progress along the maturity scale" of their ERM program.

Phoenix Park is clearly one of those companies. Says Tiah, "I would say we have absolutely gotten an exceptional return
on the investment we've made in ERM."