Three years have passed since the financial crisis of 2008 put risk management at the top of just about every corporate board’s agenda, and still it continues to confound many directors.

In fact, a new survey finds that many board members admit they don’t spend enough time on risk, and many companies still don’t have a chief risk officer or a dedicated board committee to oversee risk.

Jaclyn Jaeger is a freelance contributor to Compliance Week after working for the company for 15 years. She writes on a wide variety of topics, including ethics and compliance, risk management, legal,...