Are businesses leaving themselves hugely exposed by having weak risk management systems and in some cases none in place at all?