Although more than half of firms surveyed were hit with a high-impact/low-probability event last year, not all adjusted their risk management practices to contend with future ones, and fewer than half have an end-to-end supply chain loss control process in place, a new study revealed.

The “Excellence in Risk Management Study,” conducted by the Risk and Insurance Management Society and Marsh, listed major natural disasters, subprime market issues and product recalls as examples of high-impact/low-probability events.

According to results released at the recent RIMS annual conference in San Diego, 57 percent of firms surveyed were impacted by such an event, which might also include a terrorist threat, significant loss of brand or significant internal fraud, in the last 12 months.

“These are the things that tend to go off the radar screen because people think they’re so unlikely to happen,” said Pamela G. Rogers, senior vice president of the risk consulting practice with Marsh.

While many of the firms took action after being impacted, “we saw some firms, more on the traditional side, that really did not take action, even after being impacted by one of these risks,” she noted.

Of the firms that were affected, about 53 percent modified their policies and practices. “So quite a few did, but quite a few didn’t,” she said.

“Strategic firms” were more likely to report a high-impact/low-probability event and were more likely to modify practices as a result, the survey found. (The study defines “strategic firms” as those that use enterprise risk management approaches, while “traditional firms” use only the basic risk management tools of risk identification, loss control, claims analysis and insurance.)

Highlighting the difference between reactions of “traditional” and “strategic” firms, the study reported that if there was a significant loss in brand image, for example, only 44 percent of the traditional firms that had a significant loss actually modified their practices. Of strategic firms that had a significant loss in brand image, 100 percent modified their practices and were more proactive.

The investigation of high-impact/low-frequency events is a new area of investigation in the fifth annual study released by Marsh in collaboration with RIMS. Another new area of the report this year looks at supply chain risk management.

Ms. Rogers reported that just over half of the respondents–51 percent–said they did not have an end-to-end supply chain risk management process in place.

She clarified that while this number may seem high, because the question posed referred to an “end-to-end” process, even risk managers with 90 percent of their supply chain process in place would not be able to respond with a “yes” to the survey.

Next year, the survey will try to determine how far along they are with their process, she said.

Of more interest, however, was the percentage of risk managers–23 percent–who do not believe they have a supply chain risk, she said.

Those risk managers may believe that because they are not involved in a manufacturing process, they are not vulnerable. In fact, she said, nearly every business has a supply chain of some kind.

Of those surveyed, 26 said they have a risk management process in place for supply chains, leaving 51 percent with no risk management process.

Companies that have a risk management process for supply chains have an average of 5,241 employees, average revenues of $3.8 billion, and 66 percent have international operations.

Companies with no supply chain process have an average of 4,338 employees, average revenues of $2.6 billion, and 58 percent have international operations.

Those companies with no supply chain averaged 3,915 employees, had average revenues of $2.5 billion, and 40 percent international operations, the survey found.

According to the study, supply chains include all processes in “making, moving, storing and servicing physical goods from your suppliers’ suppliers through the end customer.”

It also comprises internal processes and external activities “performed on your behalf by suppliers, logistics partners, transportation carriers, distributors, co-packers, service and repair organizations,” and workflow/process risk.

Even in “a service firm like Marsh, there is a supply chain,” she said. “Sometimes we think of only manufacturing having that, so I think there’s an opportunity here. This is an area where we see we have a gap.”

Brian C. Eloe, managing director of Marsh, added that some of the firms responding, such as financial institutions, “may not think they have a supply chain because they don’t produce a product, per se, when in fact they have processes in their organizations that define a supply chain.”

While this could be a “definitional issue for some of them, it also might be they haven’t studied the area because they don’t think it applies to them,” he added.