Strategic firms that use enterprise risk management approaches, were found more likely to report a high impact/low probability event and were more likely to modify practices as a result, the survey found.

Ms. Rogers said, "While many of the firms took action after being impacted, we saw some firms, more on the traditional side, that really did not take action, even after being impacted by one of these risks."

Traditional firms are those that use only the basic risk management tools of risk identification, loss control, claims analysis and insurance.

Highlighting the difference between the reactions of "traditional" and "strategic" firms, the study reported that if there was a significant loss in brand image, for example, only 44 percent of the traditional firms that had a significant loss actually modified their practices. Of strategic firms that had a significant loss in brand image, 100 percent modified their practices and were more proactive.

The investigation of high impact/low frequency events is a new area of investigation in the fifth annual study released by Marsh in collaboration with RIMS. Another new area of the report this year looks at supply chain risk management.

Ms. Rogers reported that just over half of the respondents--51 percent--said they did not have an end-to-end supply chain risk management process in place.

She clarified that while this number may seem high, because the question posed referred to an "end-to-end" process, even risk managers with 90 percent of their supply chain process in place would not be able to respond with a "yes" to the survey.

Next year, the survey will try to determine how far along they are with their process, she said.

Of more interest, however, was the percentage of risk managers--23 percent--who do not believe they have a supply chain risk, she said.

Those risk managers may believe that because they are not involved in a manufacturing process, they are not vulnerable. In fact, she said, nearly every business has a supply chain of some kind.

Of those surveyed, 26 said they have a risk management process in place for supply chain, leaving 51 percent with no risk management process.

Companies that have a risk management process for supply chain have an average of 5,241 employees, average revenues of $3.8 billion and 66 percent have international operations.

Companies with no risk management process for their supply chain process have an average of 4,338 employees, average revenues of $2.6 billion and 58 percent have international operations.

Those companies who believe a supply chain does not apply to the firm averaged 3,915 employees, had average revenues of $2.5 billion and 40 percent international operations, the survey found.

According to the study, supply chain includes all processes in "making, moving, storing and servicing physical goods from your suppliers' suppliers through the end customer."

It also comprises internal processes and external activities "performed on your behalf by suppliers, logistics partners, transportation carriers, distributors, co-packers, service and repair organizations" and workflow/process risk.

Even in "a service firm like Marsh, there is a supply chain," said Ms. Rogers. "Sometimes we think of only manufacturing having that, so I think there's an opportunity here. This is an area where we see we have a gap."