Risk: judgement, not certainty
Good risk management is about making good judgements under uncertainty.
Risk is sometimes treated as though successful risk management means stopping anything bad from happening. Prevention is a good ambition, but eliminating risk altogether is rarely possible.
The real task is to understand what matters, what could threaten it, how likely and serious the consequences might be, and what we should reasonably do about it.
And there is always another side to that judgement: what are the costs and consequences of the countermeasures we might take?
Risk is a trade-off, not a guarantee
More protection is not automatically better risk management. Every countermeasure has a cost, whether in money, time, complexity, freedom or lost opportunity.
Consider witness protection. In a serious organised crime case, the potential threat to a witness may justify costly and highly disruptive measures. But we do not place every witness in every case under that level of protection.
Why? Because risk management requires proportionality. We weigh the likelihood and potential impact of the threat against the costs and consequences of mitigating it.
Some residual risk almost always remains. The important thing is that we understand it and make a conscious judgement about whether we are prepared to carry it.
A bad outcome does not necessarily mean a bad decision
A risk materialising does not, by itself, prove that the original risk decision was poor.
It may have been. But the more useful question is whether the judgement was reasonable given what could reasonably have been known at the time.
Equally, this must never become an excuse for complacency. New evidence, near misses or changing circumstances should cause us to revisit earlier assumptions and decisions. Good risk management requires learning.
A risk register is not risk management
As a functional leader, I contributed to and reviewed organisational risk registers alongside other senior leaders. At their best, they make risks visible, enable comparison and focus leadership attention.
But I have also seen how easily the process can become routine.
A risk remains on the register. Its score is reviewed. The wording changes slightly. The register appears again next month or next quarter. But nothing is done.
The existence of a risk register does not mean that risk is being actively managed.
The value lies in the thinking and decisions behind it. Are these still the right risks? What has changed? Are our assumptions still valid? Are new threats emerging? Have our vulnerabilities changed? Are our controls working? Should we be doing something differently?
Too often organisations become willing to invest in protection after something has gone wrong. Good risk management requires us to ask the harder question beforehand: what would we do after such an event had transpired, and, knowing that, what should we reasonably be doing now?
What cyber risk taught me about risk
Much of my approach to risk comes from my experience in cyber and information risk.
Early in my career I learnt CRAMM, the UK Government computer risk analysis and management method. It gave me a disciplined set of questions that has stayed with me:
- What matters?
- What threatens it?
- How likely is that to happen?
- What would the impact be?
- Where are we vulnerable?
- What can we reasonably do about it?
- What action is worth the costs and consequences?
- What risk remains?
Later, as a knowledge specialist at BAE Systems, I worked with experienced cyber practitioners to document and codify their approach to cyber risk assessment, turning practitioner expertise into a detailed, reusable toolkit.
That experience reinforced a principle I apply well beyond cyber security. Risk management is not primarily about maintaining a list of things that might go wrong. It is a structured way of thinking about what we value, what threatens it, where we are exposed and what action is proportionate.
Risk management has to keep moving
Risk decisions cannot be made once and then left alone.
Threats emerge. Vulnerabilities change. New evidence becomes available. Near misses tell us something. Actual incidents tell us more. Controls that once looked adequate may no longer be.
For a board, that means combining foresight with adaptability: looking hard enough for what might happen, while remaining willing to challenge previous assumptions as circumstances change.
When something does go wrong, the questions should therefore go beyond “Who failed to prevent this?”
What did we understand about the risk? Were our assumptions reasonable? Was our response proportionate? What has changed? And what should we now do differently?
What I bring to a board
My approach combines the structured thinking of risk assessment with practical experience of organisational risk management.
As a NED or Board Advisor, I do not pretend that every risk can be eliminated. I bring constructive challenge to the judgements being made: testing assumptions, questioning whether the right risks are receiving attention, examining whether mitigation is proportionate, and ensuring that risk management remains an active process of decision-making and learning rather than a static exercise in compliance.
Good risk management is not the elimination of uncertainty. It is the quality of the judgements we make in the face of it.