“General program measures must be instituted at the corporate level to create a culture of risk management and continuous improvement, as well as to provide a planning and response structure that is easy and cost-effective to implement with any new project.”

According to the paper, the corporate-level program institutes a cycle of continuous feedback and improvement, fostering a corporate culture of quality to improve project management, mitigate risks and minimize potential liabilities.

A check of the Allianz website revealed other papers in the series. One on developing a corporate strategy for risk management was particularly enlightening on this subject.

The article asks, “Does your company have a comprehensive strategy for defining and managing risk? Are you, as a risk manager, an integral part of this strategy? How engaged is your executive team in risk management decisions? Are you being encouraged to supply senior management with regular updates and report cards on your company's risk and its strategy?”

The answer to these questions, the article says, should be “Yes”–especially in today's volatile global marketplace. While it would be easy to view 2008 as the year that the banks fell apart, the article says 2008 should also be remembered as “the year when the true value of risk management became evident.”

Indeed, who knew the BP Deepwater Horizon disaster would follow, with risk management again being targeted?

In other words, it is abundantly clear that maintaining an ongoing partnership with the executive team is critical for a successful risk management program.

In study after study this is advocated, yet it is also reported that what is recommended isn't always followed through–and sometimes it is done in name only. If risk management isn't perceived to be a priority by an organization's leaders, the program won't receive needed support.

Unfortunately, ignoring risk management best practices leaves an organization vulnerable and can drive up insurance costs–such as workers' compensation–if a company's employee accident rates are high.

Even in this soft market, risk managers tell me their safety plans, leading to low accident rates, are keeping insurance costs down.

Bottom line, for a successful program, all roads lead to the CEO. This makes me ask why, in case after case, corporate CEOs when questioned appear to know nothing about the goings-on in their companies. The most recent example is BP. Others include Enron, WorldCom and Delphi.

While I can't really call their previous risk management efforts successful, the level of the former BP CEO's ignorance of the company's inner workings was astonishing. In fact, BP's new plan calls for risk management to report directly to the CEO. Obviously its new management knows what wasn't working and why. Time will tell how it all works out.