New study shows enterprise decision-makers improvising risk management