â–ª General program measures must be instituted at the corporate level to create a culture of risk management and continuous improvement, as well as to provide a planning and response structure that is easy and cost-effective to implement with any new project.

According to the paper, the corporate-level program institutes a cycle of continuous feedback and improvement, fostering a corporate culture of quality to improve project management, mitigate risks and minimize potential liabilities.

In study after study, this is the recommendation, yet it also is reported that what's recommended isn't always followed through and sometimes it's done in name only. If risk management isn't perceived to be a priority by an organization, the program won't receive the support it needs. Unfortunately this leaves an organization vulnerable and can drive up insurance coverage costs, such as workers' comp, if accident rates are high.

Bottom line, for a successful program, all roads lead to the CEO. This makes me ask why, in case after case, corporate CEOs when questioned appear to know nothing about the goings on in their company—the most recent example being BP. Others include Enron, WorldCom and Delphi. While I can't really call BP's previous risk management efforts successful, the level of the CEO's ignorance of the company's inner workings was astonishing. In fact, BP's new plan calls for risk management to report directly to the CEO. Obviously the new management knows what wasn't working and why. Time will reveal the effectiveness of the program.