Despite all the talk about risk management, a recent survey suggests that few companies are satisfied with their efforts, with just one out of 10 executives describing their company's risk management programs as “highly effective.” Other results of the survey of more than 1,400 global executives, conducted by Harvard Business Review Analytical Services for Zurich Financial Services, indicate that one key to successful risk management is having a single executive, like a chief risk officer, in charge.

“Risk management needs to have an effective owner,” says Mike Kerner, CEO of Zurich Global Corporate North America. “There need to be really clear roles and responsibilities. If multiple people are responsible for something, nobody is responsible.”

According to the Zurich study, companies are more likely to do advance planning for many different types of risk if they have a chief risk officer (CRO) or other C-suite executive leading risk management than are companies with no one in charge. For example, 55% of companies with a CRO have plans in place for dealing with information security risks, vs. 39% of companies where another exec heads risk management and just 36% of those with no executive in charge. Sixty percent of companies with CROs have done business continuity planning, vs. 51% of companies with another executive in charge of risk and 47% of companies with no single executive in charge of risk.