This summer, a group of global investors, alarmed by the implications of the BP disaster, called for tighter risk control measures and asked energy companies for their oil spill prevention measures. CERES also queried insurers, suggesting a more active loss control role in response to the BP disaster.

CERES said in a conference call that letters—signed by 58 global investors with collective assets totaling more than $2.5 trillion—were sent to chief executive officers at 27 oil and gas companies. The organization is currently compiling responses to the letters. Hopefully those companies took this action seriously.

Responding to the disaster, BP announced earlier it has come up with a plan to form a new risk management and safety unit reporting directly to the CEO—starting Oct. 1.

The Safety & Operational Risk function will be authorized to intervene in all aspects of BP's technical activities, BP said. It also will have its own staff of experts, which will be embedded in BP's operating units—including exploration projects and refineries.

The risk and safety unit will be responsible for ensuring that “all operations are carried out to common standards, and for auditing compliance with those standards,” BP said.

The steps BP has started implementing with its new risk management program are the very areas where enterprise risk management has fallen short in the past.

The head of BP's ERM program did not report to the CEO or board and thus had little impact implementing safety measures across the enterprise.

An important aspect of BP's risk and safety plan is the attention being paid to its supply chain. BP learned the hard way that simply outsourcing a given aspect of the job to another company doesn't exonerate BP if something goes wrong. Due diligence must be taken to make sure members of the supply chain are accountable and have strong risk management protocols in place.

While the effectiveness of the new program remains to be seen, it's better late than never. Many will be watching BP. Hopefully others in the industry—and other industries as well—will take note.

Bottom line, until risk managers are given the respect and authority they deserve in massive organizations such as BP, mega “black swan” accidents will continue to happen. While hindsight is a tough way to learn, other organizations, industries and the federal government can greatly benefit from this fiasco.