Little progress is made on risk management, study finds