Why Boards Keep Being Surprised, Even When the Data Look Fine

Editorial Note

The essays in this second series sit alongside, rather than within, the main Risk Intelligence work. They do not attempt to restate its arguments or introduce its architecture. Instead, they begin from a different place.

Each essay starts with a familiar boardroom experience: reassurance that later proves to be fragile, signals that seem important but are hard to tie down, governance that you think is working well and yet leaves something to be desired. These are not failures of effort or competence. They are simply features of governing complex organisations under uncertainty.

The purpose of this series is not to provide solutions or frameworks, but to bring patterns to the surface hat many boards recognise privately but struggle to discuss openly. The tone is lighter than in my first series, not because the issues are trivial: far from it, but because you will recognise the issues. What is often missing is not awareness, but rather the language to discuss them.

Read together, these essays are intended to sharpen attention rather than close debate. They are offered as companions to the deeper Risk Intelligence material in my first series, not as substitutes for it, and as prompts for reflection rather than prescriptions for action.

Most boards can recall the moment with uncomfortable clarity. The numbers were within tolerance, the dashboards were broadly green, the controls were signed off, and the assurance language was reassuring. And yet the event still came as a shock. A regulatory intervention, a sudden loss of confidence, a cultural failure that had been considered implausible only weeks earlier. The phrase that follows is familiar enough to have become ritualised: we did not see this coming.

What should concern us is not that boards are occasionally surprised. In complex, adaptive systems, surprise is inevitable. What is more troubling is how frequently this surprise occurs in organisations that are otherwise well governed, well advised, and well reported. These are not weak boards operating in informational darkness. They are boards operating at the peak of contemporary governance practice.

This is not a story about negligence or incompetence, nor is it a story about insufficient data. Quite the opposite. Modern boards are saturated with information. They receive detailed risk packs, control assessments, assurance opinions, stress scenarios, and increasingly sophisticated analytics. On paper, visibility has never been better, and yet orientation has not kept pace with volume.

The core problem is that for most boards reporting is designed to confirm stability rather than to detect emergence. It tells us whether agreed controls are operating as intended, whether predefined limits have been breached, and whether last year’s risks remain last year’s risks. What it does not do, at least not reliably, is help boards understand how risk is forming, shifting, or mutating across the organisation as conditions change.

This distinction matters because risk rarely emerges spontaneously. It accumulates through small behavioural changes, incentive distortions, narrative simplifications, and local workarounds that are individually rational but collectively corrosive. These dynamics often make sense at the point of action, which is precisely why they are difficult to challenge. By the time they are visible in metrics, they are frequently already embedded.

Boards understand this intuitively. It is why experienced chairs will often say, privately rather than formally, that their most valuable insights come not from the board pack but from a site visit, an informal conversation, or a remark that does not quite align with the official story. These moments matter because they cut across the grain of structured reporting and reveal tensions that formal processes smooth over.

However, intuition is not a governance strategy, and reliance on informal insight is not a scalable solution in large, regulated organisations. What has emerged instead is a fragile equilibrium. Boards rely on formal reporting for assurance while privately acknowledging that it does not fully answer the question they most care about, which is whether risk is quietly building in ways they cannot yet see. Surprise becomes the price of that unresolved gap.

It is important to be exact here. The issue is not that risk data are wrong. In most cases, they are technically accurate and diligently produced. The issue is that they are backward-looking by design. They describe what has already been agreed, measured, and normalised. They struggle with ambiguity, contradiction, and weak signals because those phenomena resist tidy categorisation and standardised treatment.

The result is an uncomfortable paradox. Boards can be well assured and poorly prepared at the same time. When surprise occurs, the organisational response is usually to strengthen controls, add metrics, and increase reporting frequency. Each of these actions is individually rational and often regulatorily encouraged. Collectively, however, they tend to increase confidence in the system without materially improving its sensitivity to early change.

Over time, this creates a subtle but dangerous drift. Organisations become more internally coherent while becoming less externally alert. The risk system grows in technical sophistication while losing its ability to orient decision-makers to what is emerging rather than what is already visible. Boards sense this erosion but struggle to articulate it within the language of existing frameworks.

From a board perspective, this is deeply unsatisfactory. Directors are not seeking perfect foresight. They are seeking orientation. They want to know where to lean in, where to ask harder questions, and where apparent stability may be masking underlying strain. Most current risk frameworks, however, were not designed for that purpose. They were designed to allocate responsibility, demonstrate compliance, and support assurance.

Boards are now being asked to govern environments that are dynamic, interconnected, and behaviourally complex using tools that assume stability, separability, and linear cause and effect. No amount of incremental refinement will fully close that gap. The question is not whether existing risk management should be abandoned. It cannot be, and should not be. The question is how it is supplemented.

What is required is a complementary discipline that treats risk not only as something to be measured and controlled, but as something that must be sensed, interpreted, and discussed before it crystallises. Such a discipline makes space for uncertainty without collapsing into vagueness. It allows tensions and inconsistencies to surface rather than smoothing them away in the name of reassurance.

That discipline does not arrive in the form of another dashboard or another taxonomy. It requires structured ways of working with weak signals, behavioural cues, and narrative drift while remaining compatible with governance and regulatory reality. RiskMetrica is being built with that problem in mind, not as a replacement for existing frameworks, but as a complement to them.

Its purpose is to help boards and executives regain orientation in environments where traditional reporting remains necessary but no longer sufficient. It is about reducing surprise not by claiming to predict the future, but by strengthening the organisation’s ability to notice when its assumptions are beginning to fray.

If boards continue to be surprised, the issue is not a lack of effort or intent. It is a mismatch between the risks they face and the tools they rely on to understand them. The real question is not why surprises happen, but how many more organisations are willing to accept before they treat early visibility as a governance capability worth investing in.