Most boards that deal with risk have an impeccable register: a likelihood–impact matrix, green and red indicators, quarterly reviews and internal audit sign-off. Yet almost none of those boards, if asked without warning, could identify the single event that could bring the business to a halt within forty-eight hours.

This is no paradox. It is the direct consequence of how Strategic Risk Management is understood almost everywhere: a compliance exercise dressed up as strategy.

Risk as a compliance obligation

The risk register is designed to be read by an auditor, rather than a decision-maker. It updates likelihood and impact on five-point scales that nobody has ever calibrated against real data, produces a colour, and that colour ends up on a slide. The slide provides reassurance: the risk has been “mapped”, so it has been “managed”. But mapping is not governing. This is where most organisations stop practising risk management and start performing risk theatre.

The most reliable symptom is separation. Cyber risk sits with IT. Physical risk sits with corporate security. Reputational risk sits with external relations. Each produces its own register, its own scale and its own colour. When a ransomware attack stops production, disrupts a critical supplier and makes the news that same afternoon, the business discovers that those three risks were not three rows in three separate matrices. They were the same event, seen by three departments that were not talking to one another.

What changes when risk becomes part of strategy

Strategic Risk Management begins where the compliance check ends: when risk stops being a peripheral report and becomes an input to decisions, carrying the same weight as the budget or business plan. The difference is not one of intensity — more audits, more policies — but of position. Risk is assessed before entering a new market, rather than after the incident that closes it.

This requires three shifts that no checklist can deliver on its own.

The first is predictive analysis in place of the incident log. A risk register looks backwards: what has already happened to us or to organisations like ours. A real strategic risk function examines weak signals — open-source intelligence, systemic vulnerabilities and critical dependencies that have not yet failed — and brings them to the board before they become news.

The second is an end to silos. Cyber, physical, reputational and operational risks are different perspectives on the same critical asset. As long as they remain in three departments speaking three languages, the business has no coherent picture of risk. It has three snapshots taken by people who have never spoken to one another.

The third is decision-making authority. A risk that the board cannot act on by stopping, slowing or redesigning an operation is documented, but it is not governed. The difference becomes visible at the worst possible moment, when someone needs the authority to stop an operation already under way, rather than the task of writing its minutes.

The question that matters

Those who work with risk know that the useful question is not “How many risks have we mapped?” It is “Which single event could stop us today — and who has the authority to recognise it before it happens?” If the answer requires more than one phone call, the risk register is doing its job. The strategy is not.

All articles →

The Strathego Method →

Author: Francesco di Castri

Topics: Security · Strategic Risk Management