In a recent survey, Deloitte and Forbes Research evaluated thestrategic risk management practices of more than 300 large globalbusinesses. The vast majority of survey respondents (81 percent)said their company explicitly manages strategic risks, whichDeloitte defines as risks that affect, or are created by, anorganization's business strategy and strategic objectives. Andalmost all (94 percent) said they've changed the way they approachstrategic risk management over the past three years.

Anecdotally, the report quotes Dr. Georg Klein, chief risk andinternal control officer, corporate finance and controlling, forSiemens AG, as saying: “In former times, we were very much focusedon quantifiable risks and had the tendency to quantify risks inorder to report them as part of our enterprise risk management.However, we found that some of the most relevant risks might onlyhave a financial implication after a couple of years, or it mighteven be quite hard to have a sensible estimate on the financialimpact of these risks. So we decided to consciously expand from apure quantification approach of risks to a more qualitativeapproach that allows integration of soft data for issues such asregulation, media, or reputation. This provides a morecomprehensive picture of the challenges that are in front of thecompany.”

Who is defining risk management priorities in large companiesaround the world? The answer varies widely by region. In theAmericas, 27 percent of organizations have their strategic riskgoals set by the CEO, 20 percent by a company-level risk committee,and 20 percent by a board-level risk committee. In only 14 percentof organizations in the Americas does the board as a wholeestablish strategic risk priorities. In Europe, the Middle East,and Africa (EMEA), by contrast, more than 50 percent of companieshave their board or a board-level committee set strategic riskpriorities, and only 9 percent give this responsibility to the CEO.(See Figure 1.)