The report, sponsored by SAS and based on a survey of 346 financial sector risk managers, reveals that most have made significant progress since the crisis to strengthen their risk capabilities.
Discussions about risk have become a key part of the boardroom agenda, chief risk officers now have a prominent seat at the top table and there is renewed zeal for instilling a greater awareness of principles in the front office, the so-called first line of defence.
However, inadequacies in expertise, data quality and processes remain a worry. The enthusiasm for a large-scale overhaul of risk management has created personnel shortages as firms and regulators scramble to acquire suitable expertise.
Around 40% of respondents says they do not conduct regular updates or have a clear risk strategy in place. Meanwhile, less than one-half of respondents are confident that they understand the interaction of risks across business lines, and poor communication between departments is seen as a key barrier to effective risk management.
In addition, the focus on regulatory compliance could distract attention from emerging risks, says the report. Respondents to the survey highlight uncertainty over future regulation as the main barrier to effective risk management. There is a danger that the focus on compliance could be crowding out day-to-day risk management.
Risk managers recognize that data quality and availability need to improve but collecting, storing and aggregating data is an area of weakness for many firms, with only 39% of respondents believing that they are effective at these activities.
Abhik Sen, report editor, says: "When it comes to managing risk, banks and insurers are clearly keen to raise their game. But the research shows that improvements have not yet gone far enough to reassure everyone about their capacity to protect themselves and others from a catastrophe like the financial crisis."
The global recession appears to have sparked a spending splurge, with the top 100 financial institutions set to spend over $100 billion a year implementing risk governance frameworks by 2012 - more than double the 2006 figure - according to recent research from business advisory firm Deloitte.