Enterprise risk management may be all the rage, but a recent study by Deloitte & Touche LLP points up some holes in the way corporations manage their risks. Its assessment of companies that suffered big stock sell-offs over the last 10 years, and the events that triggered those losses, found that almost 80% of the 100 companies with the biggest losses had been hit by two or more risks that were interrelated.

Rich Funston, practice leader for enterprise risk management at Deloitte, says companies may overlook the way that separate risks can interact because risk management is often compartmentalized by department or function. "There is a tendency within the silos to look at how it would affect us within our silo, but not look at how it would affect the entire enterprise," he says, adding that "people aren't aware of the domino effects." Funston recommends "an organization-wide response across functions, rather than within functions."

Deloitte found events that rarely occur–like the Sept. 11, 2001 terrorist attacks or the Asian financial crisis–were another trigger for the biggest losses. When companies think about their risks, they tend to focus on those that are most likely to happen, Funston says. "And yet we see there are high-impact, low-likelihood events that, if they happen, would really be value killers," he notes. Deloitte suggests that using stress tests and scenario planning for such unthinkable events is one way to prepare.