The Biggest Risk Is the One Your Board Cannot Imagine

The Biggest Risk Is the One Your Board Cannot Imagine

Most companies believe they understand risk.

They have internal controls. Risk registers. Audit committees.
Enterprise Risk Management. 
Policies, procedures and compliance frameworks.

Yet companies with all these things still suffer major failures.

Why?

Because sometimes the greatest risk is not the risk you failed to measure.

It is the risk you failed to imagine.

The Problem with Risk Registers

Traditional risk management often begins by identifying known risks, assessing their likelihood and impact, and then designing controls to mitigate them.

This is necessary, but it has a weakness.

It encourages us to think about tomorrow using what we already know today.

But the future rarely behaves exactly like the past.

Imagine a board discussing a major investment.

Management says: “There is only a 10% probability that this will fail.”

That sounds reassuring.

But what exactly does 10% mean?

• What if several individually unlikely events occur together?
• What if the assumptions behind the model are wrong?
• What if something happens that nobody even thought to put into the model?

Numbers can create an illusion of certainty.

You can measure what you know. But how do you measure what you haven't imagined?

That is where scenario analysis becomes powerful.

Don't Ask Only “What Is the Risk?”

Ask: “What if?”

Scenario analysis forces directors and management to move beyond a single prediction of the future.

Instead of saying: “This is what will happen,”

ask:

• What if sales fall 30%?
• What if our biggest customer leaves?
• What if interest rates move sharply?
• What if our supplier suddenly cannot deliver?
• What if our technology becomes obsolete?
• What if three of these happen at the same time?

The objective is not to predict the future perfectly.

Nobody can.

The objective is to expand the range of futures the board is prepared to face.

That changes risk management from an exercise in filling boxes into an exercise in strategic thinking.

Put Risk Inside Strategy

One of the most important ideas is that risk should not sit separately from the business. 

Risk exists because the company is trying to achieve something.

• Every strategic plan creates risk.
• Every major project creates risk.
• Every new product creates risk.
• Every acquisition creates risk.
• Even hiring talents is a risk. 

Therefore, risk discussions should be embedded directly into what we might call the 4Ps:

Plans. Programs. Projects. Products.

Don't approve the strategy first and ask the risk team to analyse it later.

Risk should be discussed while strategy is being created.

This is where governance can create value rather than merely protect it.

Quantitative Models Help—but Judgment Still Matters

Numbers are extremely useful.

Models can help quantify risks, understand relationships, analyse historical experience and develop mitigation plans.

Used properly, they reduce bias and subjectivity.

But models have limits.

They depend on assumptions. And assumptions are made by humans.

Sometimes a statistically unlikely event is precisely the event that can destroy the company. For example, who can imagine that the war in Middle East could hurt your businss in Europe? 

So boards need both:

Data to understand what is measurable.

And:

Judgment to imagine what may not yet be measurable.

That is why experienced, independent voices around the board table matter.

The Question Every Director Should Ask

Good corporate governance is not simply about having more controls.

Neither is risk management about eliminating risk.

Without risk, there is very little entrepreneurship.

The board's role is to ensure that management understands the risks it is taking.  Also, the organisation can survive when things do not go according to plan.

So when management presents the next exciting strategy, perhaps the most valuable contribution from an Independent Director isn't:

“Show me the risk register.” 

It may simply be: “What if we are wrong?”

Then ask: 

• What haven't we considered?
• What assumptions are we depending on?
• What happens if several things go wrong together?

And ultimately:

“Can we survive the downside?”

Because the greatest risk facing your company may already be sitting in your risk register.

But the one that changes everything may be the one nobody has thought of yet.