Legacy practices were designed for a period of greater stability and remain useful as baselines, but they were never intended to keep pace with rapid change. When relied on too heavily, they devolve into familiar outputs: two by two matrices, expansive risk registers and recurring committee cycles. The result is a process heavy on documentation that provides the illusion of completeness over strategic relevance.
One company we worked with illustrates the consequence. A small ERM team is responsible for managing 40 complex risks. When they meet with business leaders, the core question is: “What happened since the last time we spoke?” The conversation is backward looking and taxing to the risk owners they are intended to support. Strategists engage on much closer to an equal footing, engaging in sharp questions designed to probe blind spots, scenarios or emerging second order effects.
Return enterprise risk management to first principles
At its core, an enterprise risk function exists to help the organization execute its strategy, playing both a value protection (defensive) and value creation (offensive) role. Risk should build enterprise resilience: the ability to adapt strategy and maintain an organization’s fundamental commitments in the face of disruption.
Leading organizations are reassessing risk management through this lens, revisiting foundational questions to better prepare management to take informed risks and weigh strategic alternatives. Guided by a focus on prioritization, relevance and timeliness, executives are asking:
- Where are the risks to our strategy?
Too often risk assessments are based on backward-looking, historical financials with the unit of analysis risk events over strategic assumptions. Risk Strategists are flipping the script: they put future commercial offerings, business model and market position as the starting point for everything from risk appetite to risk prioritization and action. - What are the promises we can’t break?
While Strategists work to protect the growth thesis, they also work to engineer the defensive floor: what do we need to do to ensure we can maintain our unique enterprise commitments? These commitments look different for each organization and can include earnings targets with investors, the provision of critical services to customers or adherence with regulation.
A cultural and technological revolution: three actions to take now
1. Demand a change in the culture around risk
The future of ERM is as much cultural as it is technical. Leaders must feel empowered to move beyond rigid frameworks toward assessments of impact, velocity and strategic relevance. For many organizations, this often means moving away from long risk registers toward a smaller set of enterprise level risks that leadership actively debates, maintaining necessary baselines while shifting emphasis from voluminous reporting to synthesis, judgment and dialogue.
One of our clients operated for nearly 70 years without a formal risk function until it was acquired. The new leadership team decided it was time to build one. Their core question: how do we protect ourselves without adding bloat? In many ways, starting fresh put them at an advantage: they could establish protections without inheriting the layers of process and glut of reporting that often accumulate in legacy ERM programs.
2. Use technology to combine strong baselines with continuous risk sensing
Periodic risk assessments, KRIs and reviews matter: they establish discipline and a shared view of exposure. But in a NAVI world, they must be complemented by continuous risk sensing that detects shifts between formal review cycles and identifies what is becoming consequential, not just what is already documented.
