The list of key findings starts off okay, with more than 50 percent believing their risk culture is "strongly risk averse" or "risk averse." But then we discover that 44 percent of the respondents have no enterprise-wide risk management process in place and what's more, no plans to implement one.

And it goes on: 43 percent don't have their business functions establishing or updating assessments of risk exposure on any formal basis—and, more than 75 percent said their key risks are being communicated on an "ad hoc" basis at management meetings.

Not surprisingly, almost half (47 percent) said they are "not at all satisfied" or are "minimally" satisfied with the nature and extent of reporting of key risk indicators to senior executives regarding top risk exposures.

Scary? You bet. With all the emphasis on effective enterprise-wide risk management, and with the mounting issues facing organizations every day, from natural disasters to financial disasters to pandemics—and let's not forget supply chain breaks—risks are everywhere and cannot be taken lightly.

Something has to give, because the survey also found that nearly half the boards of the organizations surveyed are asking senior executives to increase their involvement in risk oversight. The board's involvement in risk, however, is being channeled through their audit committee—12 percent of which are asking directors to increase their oversight of risk "a great deal," and 46 percent asking for "extensive" oversight.

Risk managers have been challenged over and over to step up and be heard by their C-suite and board of directors. By the looks of this, that isn't happening in many cases. And if they are speaking up, they aren't being heard.

Incoming president of the Public Risk Management Association, Ron Hayes, said it well. He advised risk managers to speak up, but at the same time, to make sure they have something to say. He advised them to study the issues before speaking to upper management and at the same time, to work on getting more education and designations. Staying involved with the associations—which have excellent resources—is also advised.

This is good advice for all risk professionals, both corporate and those serving public entities.

From the looks of it, time's a-wasting. Doors are currently open to risk managers, even if only a crack, but they should take advantage of any opportunities—and if necessary, create those opportunities.