More than a decade since enterprise risk management became an accepted part of modern corporate management, most companies are still doing ERM the old-fashioned way: manually. That's the finding of two recent surveys, one conducted by Deloitte & Touche and the other by KPMG.

The Deloitte survey of 192 companies finds that despite the availability of automated risk management tools, only 25% of respondents say they continuously monitor risk. More than two-thirds say they only periodically monitor risk across their organizations.

"We were surprised to find how much the level of analytics and of continuous monitoring of risks still lags," says Henry Ristuccia, managing risk partner at Deloitte. "In part, the tools are still evolving," Ristuccia explains, but he adds there are other problems too. "We still hear people say, for example when it comes to reputation risk, 'Oh, we have a PR firm that monitors that,' but that's a response, not managing of risk."