Listed companies have lifted their game on risk governance over the past three years but many still lack the right culture and mindset, a new survey has found.

A total of 219 companies listed here were examined using annual reports available as at April 30. All of these firms said their board was responsible for risk governance, up from just 34 per cent in 2013, when the last survey was done.

And 96 per cent said they had a proper internal audit function while 95 per cent said they had whistle-blowing policies - both higher than in 2013. But it often stopped short at simply complying with the corporate governance code.

For instance, on matters outside the code, only 19 per cent stated their company risk culture, and only 5 per cent said they had a dedicated risk function, the survey done by the Institute of Singapore Chartered Accountants (ISCA) and KPMG showed. The Singapore Exchange (SGX) supported the initiative.

This suggested many firms sought only to comply with rules but might not truly see the significance or benefits of risk governance, KPMG risk consulting head Irving Low said.

"The study showed a great improvement in structure, but we need to see more improvement on the behavioural aspects - the part about people, about the tone of the (risk) culture, and the rationale of why a company should care about risk governance," Mr Low told The Straits Times.

SGX chief regulatory officer Tan Boon Gin, who attended the survey briefing, said the bourse will help create the cultural change.

"We have been focusing a lot on structural governance, but this year, we want to go beyond having just the structures. For example, we have the structural requirement for an audit committee. But how a company can implement that effectively, such that the committee can carry out its job properly - that is our interest this year and we have been engaging individual companies on this."

Big firms typically outperformed on risk governance. In all, 80 per cent of government-linked companies had a risk committee on the board, but only 12 per cent of non-GLCs did.

Mr Adrian Chan, a panellist at the briefing, believes this reflected the challenge for smaller firms to allocate resources to improve risk practices or hire the right talents for the job. He is the audit committee chairman at Ascendas Real Estate Investment Trust.

He urged the SGX to make internal audit a mandatory requirement in the listing rules. While 96 per cent of the surveyed companies had an internal audit function, it was still shocking that some listed firms did not have the process in place, Mr Chan said.