Standard & Poor’s much-touted plan to evaluate companies’ risk management efforts as part of its credit-rating decisions seems to have stalled, as S&P analysts figure out how to scrutinize risk management and whether it’s worth the extra burden to companies.

Speaking at a recent corporate governance conference in Boston, Geoffrey Buswick, head of S&P’s public-finance ratings office, frankly admitted that the idea of evaluating enterprise risk management is easier said than done.

Jaclyn Jaeger is a freelance contributor to Compliance Week after working for the company for 15 years. She writes on a wide variety of topics, including ethics and compliance, risk management, legal,...