From Assurance to Sensemaking

For much of its modern history, risk management has been organised around the idea of assurance. The objective has been to demonstrate that risks are identified, understood, and controlled within acceptable bounds. Processes have been designed to produce evidence, frameworks to enforce consistency, and reporting to confirm that the system is functioning as intended. Assurance provides comfort. It signals that uncertainty is being managed and that oversight is effective.

This model has been both necessary and, in many contexts, successful. It has brought discipline to areas that were previously informal, created shared language, and enabled organisations to operate at scale. It has also shaped expectations. Boards, regulators, and executives have come to associate good governance with the presence of clear artefacts, stable reporting, and a general sense that risk is under control.

The difficulty is that assurance is oriented towards what can be stabilised. It depends on risks being defined, categories agreed, and interpretations settled. In environments where conditions change slowly and relationships are relatively contained, this orientation can be effective. In environments characterised by speed, interdependence, and narrative volatility, it becomes increasingly misaligned with how risk actually manifests.

Across the preceding essays, a different picture has emerged. Risk does not arrive fully formed. It appears through signals that are fragmentary and often ambiguous. Narratives drift before they fail. Behaviour diverges from stated intent before it is recognised as such. Interdependence creates pathways through which disruption propagates in ways that are difficult to anticipate. In this context, the problem is not simply one of control. It is one of interpretation.

Sensemaking becomes central.

Sensemaking is not a process that replaces assurance. It is a discipline that precedes it. It concerns how organisations interpret what is happening as it unfolds, how they connect signals to assumptions, and how they adjust their understanding as conditions change. It requires attention to ambiguity, tolerance for disagreement, and the ability to revisit prior judgements without defensiveness. It is inherently less tidy than assurance, and less amenable to standardisation.

The relationship between the two is therefore not symmetrical. Assurance depends on sensemaking, but sensemaking cannot be reduced to assurance. When organisations attempt to collapse the latter into the former, they lose the capacity to recognise when their understanding is becoming misaligned with reality. What remains is a system that continues to produce evidence of control while becoming progressively less sensitive to change.

This is why the distinction is architectural. Systems designed primarily for assurance will tend to stabilise interpretation too early. They will privilege clarity over accuracy, convergence over exploration, and consistency over revision. These are not flaws in execution. They are features of the design. Addressing them requires environments that can hold uncertainty without forcing resolution, and that can make judgement visible before it is formalised.

RiskMetrica exists within this distinction. It does not replace assurance, nor does it attempt to automate sensemaking. It provides an environment in which signals, assumptions, and interpretations can be surfaced and revisited over time, allowing understanding to evolve before it is stabilised into artefacts. In doing so, it supports a different posture towards risk, one that is oriented towards alignment with reality rather than the maintenance of reassurance.

For boards and executives, this implies a shift in expectation. The presence of assurance should no longer be taken as evidence that understanding is complete. Instead, attention must be given to how understanding is formed, how it changes, and how it is challenged. This requires different questions, different rhythms of engagement, and a willingness to sit with uncertainty rather than resolve it prematurely.

This shift will not suit every organisation. In some contexts, the priority will remain on demonstrating control and maintaining stability. In others, the ability to recognise change earlier, and to act on it before it becomes formalised, will become more valuable.

The question is whether the organisation is prepared to engage in the work of sensemaking before assurance becomes possible.