Modern risk management is built around a powerful assumption: that the primary task of governance is control. Risks are to be identified, categorised, mitigated, and monitored. Deviations are to be corrected. Assurance is to be obtained. If failure occurs, it is taken as evidence that controls were insufficient, poorly designed, or inadequately enforced.
This logic is intuitive, and in stable environments it works tolerably well. But it struggles badly in the conditions most organisations now inhabit: complexity, speed, ambiguity, and interdependence. In those settings, the central challenge is not controlling known risks, but interpreting what is happening before it becomes obvious.
This gap is not new. It has been diagnosed repeatedly over the past half-century. What is striking is not the absence of insight, but the absence of design.
A number of influential thinkers recognised early that risk could not be reduced to technical calculation alone. Karl Weick argued that organisations operate through sensemaking: the ongoing, social process by which people construct meaning under uncertainty. Ulrich Beck described modern risk as manufactured, systemic, and politically mediated, rather than external and observable. Michael Power showed how risk management expanded as a ritual of reassurance, often detached from substantive understanding.
Others extended the diagnosis. James Reason demonstrated that failure emerges from systems, not isolated acts. Daniel Kahneman exposed the cognitive shortcuts that distort judgement under uncertainty. Donald MacKenzie showed how models do not merely describe reality, but actively shape it.
Taken together, this body of work offered a devastating critique of naïve control thinking. It explained why linear defences fail, why assurance breeds overconfidence, and why organisations are surprised by events that later appear obvious.
What it did not do was redesign governance.
Instead, these insights were absorbed selectively, often rhetorically, while the underlying architecture of risk management remained largely unchanged. Sensemaking became something organisations claimed to value, but did not structurally support. Behavioural insight became a training topic, not a governance principle. Complexity was acknowledged, then quietly ignored in favour of frameworks that promised clarity.
The result is a persistent mismatch. Organisations talk about uncertainty while operating systems designed for certainty. They acknowledge complexity while relying on linear escalation paths and static taxonomies. They celebrate challenge while rewarding reassurance.
To understand why this matters, it is useful to clarify what sensemaking actually involves. Sensemaking is not analysis after the fact. It is the capacity to notice weak signals, tolerate ambiguity, and revise understanding as new information emerges. It depends on dialogue, trust, and interpretive judgement. It cannot be reduced to metrics or delegated entirely to functions.
Control-based systems, by contrast, are optimised for consistency and comparability. They require risks to be named, bounded, and owned. They favour clarity over doubt and closure over exploration. Over time, this creates a subtle but powerful pressure to resolve uncertainty prematurely, because unresolved uncertainty does not travel well through formal governance processes.
This is why so many failures follow the same pattern. Early signs are present, but they are fragmented, ambiguous, or inconvenient. They do not fit existing categories. They are raised informally, then normalised, reframed, or deferred. By the time they are formally recognised, they have already hardened into outcomes.
At that point, control systems activate fully. Investigations are launched. Lessons are identified. New controls are added. The cycle repeats.
What is missing is not intelligence, but interpretive capacity. Organisations are good at reacting to what has already happened. They are much weaker at staying with uncertainty long enough to understand what might be happening.
This is the unfinished project of modern risk theory. The diagnosis was clear: uncertainty cannot be governed through control alone. But the response stopped short of re-engineering how organisations listen, question, and make sense of themselves in real time.
Until governance structures are designed explicitly to support sensemaking, risk management will remain trapped in a paradox. It will become ever more elaborate, even as its ability to prevent surprise diminishes.
Control will continue to expand. Understanding will continue to lag.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 2 February 2026 on my Substack.