Companies are neglecting a key area of risk management