According to the survey of 150 senior-level executives, 53 percent said they are effective at identifying and managing significant risk. However, 47 percent rated their organizations less than "very effective," leaving them vulnerable to unanticipated losses, reduced productivity and business disruptions. 

Among companies that rated themselves as "not very effective," 77 percent are planning at least some changes to their risk management capabilities over the next two years, and 14 percent plan significant changes. 

Nearly half of the "not very effective" companies noted that a single event prompted the decision to change. Protiviti said this finding is important because it implies an ad hoc, reactive state for companies lacking high confidence in their risk management capabilities.

"Having now completed three years of Sarbanes-Oxley compliance, it's increasingly clear that the largest U.S. companies are finally focusing on other risks beyond regulatory and compliance-related issues," said James Pajakowski, managing director and Protiviti's leader of Business Risk Solutions.

A copy of the Risk Barometer report is available at www.protiviti.com/go/usriskbarometer2007.