A new survey of global financial firms finds that, while there has been progress towards stronger risk management, challenges remain.

A report from Ernst & Young, in conjunction with the Institute of International Finance, observed a “significant increase” in the overall resources that are being deployed to strengthen risk management and risk governance. But it also found that there is still plenty of work ahead.

“This is the third annual survey of its kind and the results show clearly that the structure of risk management has undergone a significant change since before the 2008-2009 financial crisis,” says Patricia Jackson, Ernst & Young’s head of financial regulatory advice, Europe, Middle East, India and Africa, who directed the survey. “However, there is still much to be done to change and fully integrate new methodologies and processes.”

“For example, risk appetite – the amount and type of risk that a company is able and willing to accept in pursuit of its business objectives – has emerged post-crisis as a critical foundation of the risk management process, but our survey finds that embedding risk appetite across all levels remains a key challenge for many firms,” she notes.

Rick Waugh, president and CEO of Scotiabank, who also chairs the IIF’s Committee on Governance and Industry Practices, noted that firms are making major increases in the number of staff they assign to risk management functions, but that there needs to be cultural change too.

“Boards of directors and senior management teams recognize that core issues of corporate culture are crucial to sound risk management. Incentives need to be set appropriately and, over and above all the technical systems improvements, there needs to be an acute understanding that good risk management demands excellent judgment,” he said. “The proper risk culture, understanding the right balance of risk appetite, and the right balance of risk/reward, are essential to mitigating future crises, without which, no amount of capital or prospective rules will hold us safe.”

All of the changes in risk management are causing banks to increase their investments on IT, the survey says.

And, it also found that the new Basel III capital requirements are significantly changing the industry, with 65% of respondents evaluating their portfolios, 30% exiting lines of business, and 13% exiting countries.

Firms also predicted that the changes will have a significant effect on the costs of doing business, it says. The result will be that return on equity will go down, costs and leverage will have to be reduced, and margins will have to go up.

The survey, conducted from December 2011 through March 2012, included 75 IIF firms with headquarters in 38 countries.