Companies have two major decisions to make when thinking about handling risk: where risk responsibility resides in management and at the board level.

At executive level, corporate thinking is starting to examine whether a designated chief risk officer (CRO) might be appropriate. Similarly, at board level, there is lively debate over whether a dedicated risk committee should be established.