Across large organisations, risk management activity has grown relentlessly. Boards receive thicker packs, more dashboards, more formal attestations, and more assurance mapping than at any time in memory. Risk committees are busy. Control frameworks are mature. Escalation processes are documented in detail.
On paper, this looks like progress.
Much of it has been driven by understandable motives. Repeated failures exposed genuine weaknesses in oversight and accountability. Regulators demanded clearer evidence that risks were being identified and managed. Boards wanted reassurance that they would not be caught unawares again. Organisations responded by formalising risk, documenting it, and embedding it into governance routines.
Yet the uncomfortable pattern remains. Major failures still arrive “unexpectedly”, followed by reviews that conclude the risks were known, discussed, and documented. The warning signs were present. The frameworks were operating. And still, nothing meaningful changed.
The problem is not a lack of risk management effort. It is that, over time, risk management has drifted from being a governing discipline into a ritualised activity.
Ritual does not imply bad faith. In organisations, rituals are often performed conscientiously. Their purpose is reassurance. They signal that the right steps have been followed, that recognised forms have been completed, and that governance expectations have been met. What matters is recognisability and compliance with process, not the quality of insight produced.
Modern risk management increasingly fits this pattern. Risk registers are updated on schedule. Appetite statements are refreshed annually. Controls are tested and signed off. Heat maps are recalibrated. The cycle repeats with impressive consistency. What is far less consistent is whether these activities materially change how decisions are made.
Consider Carillion. In the years preceding its collapse, Carillion was not operating without risk frameworks, internal audit, or board oversight. Risks relating to contracts, cash flow, and aggressive accounting were visible. What failed was not identification, but interpretation and challenge. The system continued to process reassuring artefacts while the underlying business model deteriorated.
Or take Volkswagen. Dieselgate was not the result of an absence of controls or compliance processes. It emerged from a high-performance culture in which targets, incentives, and authority gradients made certain questions effectively unaskable. Formal risk processes existed, but they were structurally incapable of surfacing ethical and strategic contradictions that cut across silos.
In both cases, the risk system functioned smoothly right up until it did not.
One reason ritualised risk management fails is that it privileges stability over surprise. Frameworks are designed to categorise known risks, assign ownership, and track mitigation within predefined boundaries. Weak signals that do not fit existing taxonomies are harder to express, harder to escalate, and easier to ignore. Over time, silence becomes normalised.
Another reason is the gradual substitution of form for judgement. The presence of a documented process becomes evidence of control. Questions shift from “What does this mean for us?” to “Has this been completed?” Risk conversations become procedural, even when the risk itself is behavioural, strategic, or systemic.
This has predictable behavioural consequences. Managers learn what the system rewards. They learn which risks can be raised safely and which create friction. Information adapts accordingly. None of this requires cynicism or bad intent. It is a rational response to how organisational systems work.
The irony is that as rituals become more elaborate, the illusion of control strengthens. Boards see more information, but their capacity to distinguish signal from noise weakens. Risk appears to be everywhere in form, yet nowhere in substance. When failure finally surfaces, it feels sudden only because the organisation has lost the ability to listen to itself.
This also explains the familiar post-crisis reflex. When risk management fails, the response is almost always to add more structure. More controls. More attestations. More reporting. The assumption is that the ritual was insufficiently rigorous, rather than that ritual itself displaced sensemaking.
None of this is an argument against structure, documentation, or assurance. These remain necessary. But when risk management exists primarily to demonstrate diligence rather than to support judgement under uncertainty, it ceases to function as a governing discipline.
The deeper risk is not that organisations lack frameworks. It is that they lose the capacity to surface uncomfortable truths early enough to matter. When ritual overtakes discipline, surprise is no longer an anomaly. It is the inevitable outcome.
Richard Anderson
Founder, AndersonRisk
This essay was first published on 19 January 2026 on my Substack.