For boards, audit committees and management keen to address the issue of risk management, the Ernst & Young study emphasises several key steps that require attention:

Risk management needs to address whole-of-business risk, not just insurable or auditable risks.Risk management systems must report the emergence of new risks and the impact on existing risks of changing business conditions.The entire management team needs to take responsibility for the identification and assessment of risk rather than delegating it to a risk manager or internal audit.A common definition of what constitutes risk needs to be developed for each organisation to ensure consistent understanding.What constitutes an acceptable level of risk for each organisation needs to be defined - some will be more risk-averse than others.Risk management systems need to be capable of reporting risks that fall outside acceptable criteria.Risk management needs to be an ongoing concept, not something that is addressed periodically.Risk management policies should be developed and communicated throughout the organisation.