Effective data strategies are important for risk management. Surveys from 2008 and 2010 show that companies have made progress in clearly defining objectives and risk appetite, and better integrating risk management into strategic planning. Companies are also moving from defensive to more proactive risk management aimed at business value. Technology has enabled more automated risk identification, analysis, quantification, reporting and monitoring. Experts emphasize the importance of board commitment, dedicated executive leadership, a risk-aware culture, stakeholder engagement, transparency, and using risk data to inform decision-making rather than just avoid risks. Both internal and external data from multiple sources are needed for risk management, but data quality, governance, availability and standards must be addressed.