If you accept the view of risk developed in the preceding essays, one implication follows immediately: risk intelligence is not primarily about frameworks, controls, or reports. It is about whether an organisation can still recognise emerging danger before it becomes undeniable.
That capacity is revealed less by what a board receives than by what it asks.
The following questions are not intended to be exhaustive, nor should they be deployed mechanically. They are diagnostic prompts. Each is designed to surface how the organisation actually behaves under uncertainty, rather than how it describes itself.
The first question is deceptively simple:
Where are we currently most uncomfortable, and why?
Discomfort is often the earliest indicator of risk. Boards that move too quickly to resolve it lose valuable signal. The point of the question is not to eliminate unease, but to understand its source and distribution.
Second:
What would have to be true for our current strategy to fail, even if execution is competent?
This question deliberately separates competence from outcome. It creates space to explore fragility, assumption dependence, and external interaction without attributing blame.
Third:
Which risks do people hesitate before raising, and what does that hesitation tell us?
Hesitation is rarely random. It usually reflects past experience of how challenge has been received. Boards that pay attention to what is hard to say learn more than those that reward fluent answers.
Fourth:
Where are we relying on coherence rather than evidence?
Well-aligned narratives are comforting. They are also dangerous. This question probes whether consistency has become a substitute for verification.
Fifth:
What has changed in the organisation’s behaviour that would not be visible in our risk reports?
Culture, pressure, and incentive drift rarely appear on dashboards. This question invites discussion of lived reality rather than reported position.
Sixth:
Which risks sit between owners rather than with them?
Emergent risks often fall into the gaps between functions, committees, or organisations. If no one feels authorised to act, the risk will persist by default.
Seventh:
What would a well-intentioned person have to do to make this risk worse?
This question reframes risk away from malice and towards system dynamics. It helps boards see how rational behaviour can still produce adverse outcomes.
Eighth:
When did we last slow down a decision because the risk signal was unclear, and what happened as a result?
Boards often claim to value caution, but behaviour tells a more accurate story. This question tests whether patience is real or rhetorical.
Ninth:
Which assurances do we rely on most, and how would we know if they stopped being reliable?
Assurance is never absolute. This question shifts attention from comfort to contingency, and from trust to verification.
Tenth:
If this organisation were surprised in eighteen months’ time, what would we wish we had taken more seriously now?
This is not prediction. It is perspective. It forces the board to imagine hindsight before it arrives, while there is still room to act.
None of these questions guarantees safety. That is not their purpose. Their value lies in what they legitimise: doubt, exploration, and challenge.
A board that asks these questions regularly will not eliminate uncertainty. But it will make uncertainty discussable. And in complex systems, that is often the difference between risk being managed early and failure being explained later.
Risk intelligence does not begin with better answers. It begins with better questions, asked in a way the organisation can afford to hear.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 2 March 2026 on my Substack.