Any research at all about the success of an enterprise riskmanagement program, or any risk management program for that matter,points to the CEO's support.

Without that, the risk manager has little chance of implementinga program with any impact to speak of. Without out the blessing ofthe C-level, most safety or other programs a risk manager tries toimplement will be shelved by department managers who are too oftenunderfunded and understaffed.

I was reminded of this fact today, reading a white paper byAllianz, titled “Preventing Water Damage: What Risk andConstruction Project Managers Need to Know.”

To create a best practices program to prevent and mitigate waterdamage, this item tops the list:

â–ª General program measures must be instituted at the corporatelevel to create a culture of risk management and continuousimprovement, as well as to provide a planning and responsestructure that is easy and cost-effective to implement with any newproject.

According to the paper, the corporate-level program institutes acycle of continuous feedback and improvement, fostering a corporateculture of quality to improve project management, mitigate risksand minimize potential liabilities.

In study after study, this is the recommendation, yet it also isreported that what's recommended isn't always followed through andsometimes it's done in name only. If risk management isn'tperceived to be a priority by an organization, the program won'treceive the support it needs. Unfortunately this leaves anorganization vulnerable and can drive up insurance coverage costs,such as workers' comp, if accident rates are high.

Bottom line, for a successful program, all roads lead to theCEO. This makes me ask why, in case after case, corporate CEOswhen questioned appear to know nothing about the goings on in theircompany—the most recent example being BP. Others include Enron,WorldCom and Delphi. While I can't really call BP's previous riskmanagement efforts successful, the level of the CEO's ignorance ofthe company's inner workings was astonishing. In fact, BP's newplan calls for risk management to report directly to the CEO.Obviously the new management knows what wasn't working and why.Time will reveal the effectiveness of theprogram.