Each exchange can be different. Essentially with every bit of funds held at an exchange, either fiat or bitcoins, the account holder becomes an unsecured creditor of the exchange.
Regulated exchanges of other securities, commodities and currencies and brokers of those exchanges have clear instruction to keep customer funds segregated from the operating funds so that those funds are not at risk if the exchange itself runs into financial issues.
Whether any of these regulations affect a Bitcoin exchange or brokerage may vary based on jurisdiction. It is possible these exchanges are operating without any regulatory oversight and thus no guarantee that they are holding all customers funds without lending those funds out or using those to fund operations.
An exchange that accepts deposits from an account-to-account (A2A) transfer could help lessen the risk. For instance, Camp BX and Mt. Gox accept deposits from Dwolla. So holding dollars at Dwolla until they will be used for trading is one approach to lessening the risk of keeping the funds at the exchange the whole time. BitFloor accepts CapitalOne 360/ING transfers, as another A2A example. And multiple exchanges accept transfers from OKPay.
Additionally there are site security concerns. If the service gets hacked, or an individual account gets hacked, those funds could be used to buy bitcoins and withdrawn -- with the losses assessed to the account holder. Use of two-factor authentication is essential a core requirement.