Writing

Every few months, the risk management community returns to a familiar argument that if something cannot be quantified, it cannot be managed.

Across large organisations, risk management activity has grown relentlessly. Boards receive thicker packs, more dashboards, more formal attestations, and more assurance mapping than at any time in memory. Risk committees are busy. Control frameworks are mature.

When organisations talk about trust failure, they usually reach for ethical language. They speak of values, integrity, tone from the top, and individual wrongdoing. Investigations focus on who knew what, who should have acted, and where accountability lies. Training programmes are refreshed.

Artificial intelligence is being presented as the next great solution to risk management. Vendors promise earlier detection, better prediction, continuous monitoring, and objective insight.

Modern risk management is built around a powerful assumption: that the primary task of governance is control. Risks are to be identified, categorised, mitigated, and monitored. Deviations are to be corrected. Assurance is to be obtained.

The Three Lines Model has become one of the most widely adopted organising frameworks in modern governance. Boards recognise it. Regulators reference it. Assurance functions are designed around it.

After every major failure, the regulatory response follows a familiar pattern. Controls are strengthened. Reporting requirements expand. Supervisory expectations are clarified. Assurance thresholds rise. From the outside, this looks like learning. The system appears to be correcting itself.

Most boards believe they have a clear view of their organisation’s risk appetite. There is usually a statement approved annually, often supported by metrics, tolerances, and heat maps. It is discussed seriously, minuted carefully, and referenced in governance papers.

When organisations talk about improving risk culture, the conversation often turns quickly to measurement. Surveys are commissioned. Scores are benchmarked. Heat maps are produced. Results are tracked over time. Culture becomes something that can be quantified, monitored, and reported to the board.

Most organisations still govern risk as if the boundary of the firm were clear. Responsibilities are mapped to internal functions. Controls are designed around owned processes. Assurance focuses on activities that sit within formal organisational lines.

Boards rarely fail because they do not care about risk. Most spend significant time on it. Papers are reviewed, committees are active, and assurance is sought. The problem is not attention. It is orientation.

If you accept the view of risk developed in the preceding essays, one implication follows immediately: risk intelligence is not primarily about frameworks, controls, or reports. It is about whether an organisation can still recognise emerging danger before it becomes undeniable.

The essays in this second series sit alongside, rather than within, the main Risk Intelligence work. They do not attempt to restate its arguments or introduce its architecture. Instead, they begin from a different place.

Assurance occupies a privileged position in modern governance. It comes with formality, professional language, and the implied authority of process. Controls are tested, opinions are formed, and statements are signed. For boards operating in complex and regulated environments, this matters.

Electricity systems across Europe are increasingly powered by low-cost renewable generation. Wind and solar now supply a substantial share of electricity in many markets, including the United Kingdom. Yet electricity prices remain closely tied to the price of natural gas.

Boards are accustomed to working from structured information. The risk pack arrives on time, professionally assembled, and aligned to an agreed framework. It provides consistency across periods, comparability across business units, and a shared basis for discussion.

Modern governance has achieved a great deal. Roles are clearer than they once were. Responsibilities are documented. Escalation paths are defined. Boards can demonstrate oversight in ways that would have been difficult to evidence a generation ago.

At critical moments in board discussion, the language often becomes less technical and more human. After the analysis has been presented and the options explored, someone, usually the chair, will ask a deceptively simple question.

Over the past six to twelve months, I have written and published a series of essays exploring Risk Intelligence as a discipline. Those pieces were necessarily conceptual.

For as long as organisations have attempted to manage risk formally, they have sought to make it visible. Visibility has been treated as a virtue in itself, and static dashboards have become the dominant expression of that belief.

Risk registers were created to impose order. They offered a way to catalogue threats, assign ownership, and demonstrate that uncertainty was being taken seriously.

Artificial intelligence has entered the risk management domain with remarkable speed and little reflection. Vendors promise earlier detection, deeper insight, and the ability to see patterns humans miss.

Modern organisations are deeply comfortable with programmes. When a problem is recognised, the instinctive response is to design an initiative, define milestones, appoint owners, and declare success once the artefacts are in place. Risk management has followed this pattern for decades.

Boards are accustomed to being offered reassurance. Risk reporting, assurance statements, and control attestations are framed as protections against surprise and failure. Over time, this has shaped expectations about what good governance feels like. It feels orderly, complete, and calm.

Organisations rarely fail because they lack information. They fail because the story they tell themselves about that information no longer holds, and no one is able, or willing, to say so clearly enough.

Risk appetite is often presented as the point at which strategy and risk meet. It is described as a statement of intent, a boundary within which the organisation is prepared to operate, and a guide to decision-making under uncertainty.

Organisations often describe adverse outcomes as surprises. The term is used to signal that an event was unforeseen, that available information did not indicate its likelihood, and that reasonable processes were followed. It carries an implicit defence.

Modern boards are not short of information. Board packs have expanded in volume and sophistication, incorporating financial analysis, risk metrics, performance indicators, and increasingly, predictive insights.

Organisations are often assessed as if they were self-contained. Strategies are evaluated within organisational boundaries, risks are catalogued within internal frameworks, and controls are designed to manage exposures that can be clearly attributed.

Organisations have invested heavily in reducing the time it takes to produce risk information. Reporting cycles have been shortened, dashboards updated more frequently, and data pipelines accelerated. The expectation is straightforward.

For much of its modern history, risk management has been organised around the idea of assurance. The objective has been to demonstrate that risks are identified, understood, and controlled within acceptable bounds.

Over the past few weeks I have been writing a series of essays on Risk Intelligence. They began with familiar artefacts such as dashboards and registers, and moved through signals, narrative, appetite, and the experience of surprise, before arriving at boards, interdependence, and the limits of…

IntroductionI was listening not so long ago to a BBC series by Rory Stewart about ignorance. It resonated greatly with my views and linked to my approach to leadership: seek out uncertainty, look for resonance and leverage difficult learning.

You might well observe that the three key words in the title are the wrong way round. Surely entrepreneurialism comes first.

In my recent conversation with Curly Moloney on my podcast we were riffing briefly on the idea of DAOs (Decentralised Autonomous Organisations which operate through blockchain technology) replacing most of the functions of a board, but that such organisations would still need real people for “tiller.

I had the absolute pleasure of speaking to a group of NEDs at a Dynamic Boards meet up on the subject of risk management. Here is the video: