Even as economies show signs of recovery from the global financial crisis, respondents to Aon's biennial Global Risk Management Survey still saw economic slowdown as the top risk.

As with 2009, regulatory data and legislative changes was second on the 2011 list of the top 10 risks. Increasing competition was cited as the third largest risk, up one spot from the earlier survey.

Rounding out the top 10 were, in order: Damage to reputation and brand, business interruption, failure to innovate or meet customer needs, failure to attract or retain top talent, commodity price risk, technology or system failures and cash flow or liquidity risk.

The latest risk survey, conducted online in late 2010 in nine languages, encompassed 960 respondents from 58 countries in all regions of the world. About 44 percent of the respondents were privately owned companies, while 40 percent were publicly held organizations and the remainder were government or nonprofit entities.

Among the findings:

• Risk readiness Sixty-four percent of respondents felt their organizations had adequately prepared for economic slowdown, compared with 60 percent in 2009. Sixty-five percent felt ready for regulatory data and legislative changes, unchanged from 2009. Seventy-one percent were ready for increasing competition, the same as 2009.

The highest percentage for risk readiness, 77 percent, was cited for cash flow and liquidity risk, up from 75 percent in the prior survey. Respondents felt least ready for failure to attract or retain top talent—60 percent cited this risk. Damage to reputation and brand was cited by 61 percent, up from 58 percent in the earlier survey.

• Total cost of risk (TCOR) The survey asked respondents how they measured the elements of TCOR. Risk transfer costs were the element most measured, by 86 percent of respondents, down from 92 percent in 2009. Risk retention costs were measured by 66 percent, vs. 74 percent in 2009. Fifty-five percent measured external risk management costs, down from 60 percent, while 39 percent measured internal risk management costs, down from 44 percent in the earlier survey.

Among reasons cited for not reporting any TCOR elements, 39 percent of respondents cited lack of resources/expertise, 36 percent cited lack of data/information, 30 percent said they didn't find the process valuable, and 21 percent said they didn't measure the cost of risk at all.

• Role of chief risk officer (CRO) Since 2009, slightly more respondents reported their organizations had a CRO. Thirty-one percent said they had a CRO, vs. 25 percent in the prior survey. Nineteen percent of the respondents had a CRO whose role does include risk management, vs. 14 percent in 2009, and 12 percent said the role did not include risk management. Six percent of respondents said they did not have a CRO but were considering creating such a position, down from 10 percent. Sixty percent did not plan to create such a position, down from 62 percent in 2009.