The Business Case for Risk Management Begins With Better Decisions

Key Takeaways

• Measuring Risk Management's Value: Enterprise risk management should be evaluated by its contribution to better decisions and organizational objectives, rather than the number of risks identified, assessed, or reported.
• Risk Intelligence in Strategic Decisions: Risk professionals should help leadership compare opportunities, investments, and uncertainties before strategic decisions are made, while continuing to assess the likelihood of achieving objectives afterward.
• Risk Appetite and Investment Choices: Organizations accept uncertainty in pursuit of value. Risk appetite and treatment analysis should help executives evaluate competing investments, allocate resources, and understand the trade-offs involved.
• Governance and Organizational Culture: Effective risk management depends on boards and executives who demand candid assessments of uncertainty, challenge assumptions, and are prepared to act on information that questions preferred strategies.
• Connecting Risk to Business Objectives: Strategic priorities must remain connected to persistent financial and operational exposures, with risk intelligence incorporated into everyday business decisions rather than confined to separate reporting exercises.

Deep Dive

We have become remarkably good at documenting risk. We can identify it, categorize it, assign ownership, measure it, and report it through dashboards of considerable sophistication. We can demonstrate how thoroughly an organization has assessed its exposures and how diligently its risk committees have reviewed them. But what has the organization gained?

That question deserves more attention than it generally receives. A completed risk assessment is evidence that work has been performed. It is not, by itself, evidence that the work has improved a decision, protected an objective, or made better use of the organization's resources.

In my earlier article, I reflected on Risk That Pays: Measuring the Impact of Better Decisions, a StrategicRISK webinar held in association with Face the Risk. I joined Eileen Ludden, founder of Face the Risk; Tim Leech, Managing Director of Risk Oversight Solutions; and Dr. Sonjai Kumar, a risk management researcher and practitioner, in a discussion chaired by Katie Scott, Content Director, Insurance and Risk at StrategicRISK.

We came at the question from different directions. Tim examined whether boards and management genuinely want information about uncertainty. Eileen considered how investment and risk-treatment portfolios could be evaluated against business objectives. Sonjai emphasized the need to connect strategic priorities with the exposures already present throughout the organization. My own concern was with the decisions that establish those priorities in the first place.

The discussion reinforced something I have argued for some time. Risk management cannot establish its value merely by demonstrating that risks exist, or that the organization has processes for managing them. Its contribution must be understood in terms of the decisions it improves and the objectives it helps the business achieve.

Risk Management Should Begin Before the Decision

Consider an organization planning to enter a new market. Management might acquire an existing business, establish its own operations, work through a local partner, or begin with a limited pilot. It might also decide that the opportunity does not justify an investment at present. Each alternative offers different possibilities for creating value. Each requires resources, depends on assumptions, and carries uncertainty.

What should risk management contribute to that decision? The conventional approach often begins after management has selected its preferred course of action. The risk function is asked to identify what might prevent the strategy from succeeding, assess the exposures, and recommend appropriate treatments. That work matters, but it leaves an important part of the decision untouched.

Before management commits to a strategy, someone should be helping it understand how the alternatives compare. What value might each create? What would it cost? What assumptions would have to prove correct? What uncertainty would the organization be accepting, and is that uncertainty justified by the expected benefits? Risk management has a role in answering those questions.

Once the decision has been made, the analysis changes. The organization now has objectives and commitments against which performance can be evaluated. Management needs to understand the uncertainty surrounding delivery, whether its assumptions remain credible, and whether changing circumstances call for a different approach.

These are two parts of the same responsibility: helping the organization choose what to pursue, and helping it understand whether it can achieve what it has chosen. We should not confuse assessing the risks of a strategy with evaluating whether that strategy was the right choice.

Appetite and the Choice Between Options

I have long questioned the usefulness of risk appetite statements that describe an organization's general disposition toward risk without explaining how that disposition should influence a decision. We are all familiar with declarations of a high appetite for innovation, a moderate appetite for commercial risk, or a low appetite for reputational damage. They may communicate something about management's intentions. They do not necessarily help an executive choose between competing investments.

My argument is that organizations have an appetite for value, and they accept uncertainty in pursuit of it. Appetite therefore has to be considered against what the organization is trying to accomplish, which is where the market-entry decision becomes useful.

Suppose management is willing to commit up to $2 million initially and has set a boundary: no more than a 10% estimated probability that cumulative net losses will exceed $1 million over three years. The alternatives can now be evaluated against those parameters and against the value each could create. A partnership may offer a smaller potential return but require less capital. Direct entry may promise greater value while exposing the organization to more uncertainty. A pilot may allow management to test its assumptions before committing further resources.

The analysis helps establish how the options compare. Leadership determines which trade-offs it is prepared to accept. If the analysis estimates an 8% probability of losses beyond that threshold for one of the options, the 8% is a forecast based on assumptions and the available evidence. The 10% expresses the organization's willingness to accept uncertainty. The model informs the decision. It does not determine what the organization should value or how much uncertainty it should be willing to accept.

The choice also changes the work that follows. If management selects the pilot, it then sets objectives for customer acquisition, contribution to margin, delivery, and the evidence it will need before expanding. Risk management now supports execution against those objectives, as well as the next decision about whether to go further.

Nor should one appetite statement be expected to govern every activity equally. An organization may accept considerable commercial uncertainty in developing a new product while tolerating very little variation in the reliability of an essential service.

Appetite becomes useful when it helps distinguish acceptable choices from unacceptable ones. It should be possible to explain why one investment falls within the organization's boundaries and another does not. Otherwise, we have described a preference without providing much help to the people making the decision.

Risk Treatments as Business Investments

Eileen Ludden approached the question of value through the evaluation of investment portfolios. Organizations routinely compare competing demands on capital. They decide which projects to fund, which capabilities to develop, and which investments contribute most to their objectives. Risk treatments should be subject to a similarly disciplined examination.

A proposal to strengthen cybersecurity or improve business continuity should not rely solely on demonstrating that the underlying exposure is significant. It should explain what the proposed investment is expected to change, which means considering what different combinations of treatments would contribute, what they would cost, and what uncertainty would remain.

The relationships are rarely simple. One treatment may influence several possible events, and those events may affect several objectives. Evaluating each control independently can obscure the effect of the portfolio as a whole.

Eileen discussed modeling the existing treatment portfolio alongside alternatives, including examining the efficient frontier of possible choices, to show the trade-offs between the resources committed and the benefits different combinations might provide. The same modeling lets leadership see how the recommendation changes when priorities change. An organization that places greater weight on safety, for example, may reasonably favor a different treatment portfolio from one operating under other priorities. As Eileen put it, the risk team should inform the analysis while leadership determines the priorities against which the choices are evaluated.

We must also be careful about what such analysis establishes. A modeled benefit is not a realized return. Estimates of treatment effectiveness depend on assumptions, and those assumptions should be open to examination. Assigning a financial value to an expected improvement does not make the improvement certain.

A credible business case explains what the proposed investment is expected to accomplish, why it is preferable to the alternatives, and what evidence will be needed to determine whether the expected benefits have been achieved.

Whether Anyone Wants to Know

All of this assumes that someone wants the analysis. Tim Leech raised the more uncomfortable possibility that the organization may not particularly want a candid assessment of its prospects.

In Mission-Critical Governance: Focusing on What Matters Most, Tim describes a "Don't Tell, Don't Ask" governance syndrome, in which management may be reluctant to expose the uncertainty surrounding its preferred strategy while boards do not consistently ask for a clear picture of risk and performance against mission-critical objectives.

The difficulty, then, is not necessarily a shortage of risk information. An organization can possess extensive assessments, sophisticated models, and experienced risk professionals without establishing a governance environment in which their findings influence decisions. If management regards uncertainty as something to be explained away when seeking approval, better analysis may accomplish very little. The same is true when boards accept reports without examining what those reports imply for the objectives they are responsible for overseeing.

Tim's objective-centric approach asks organizations to establish which objectives are mission-critical and to examine performance and uncertainty against them. That is a considerably more useful starting point than asking whether the risk register has been updated. It also requires management and the board to agree on what matters most. Without that agreement, the risk function may produce information that is technically sound but disconnected from the questions leadership ought to be asking.

Sonjai identified culture as an underdeveloped element that helps explain why risk management does not always work as intended, and I think he is right. An organization may have measurable boundaries, sophisticated assessment methods, and formal reporting arrangements. Their usefulness depends on whether people are willing to acknowledge uncertainty, challenge assumptions, and disclose evidence that conflicts with expectations. That willingness is tested hardest when a proposed investment or strategy already has influential supporters. Risk analysis should not become a means of confirming a decision management has effectively already made.

We need better analysis. We also need people who are prepared to use it, particularly when the findings challenge an established assumption or a preferred course of action. There is little value in improving the precision of information that nobody intends to act upon.

Objectives and Persistent Exposures

Sonjai also introduced an important qualification to objective-centric risk management. Organizations face persistent exposures that do not disappear when management changes its strategy. Credit risk, liquidity risk, interest-rate risk, and other financial and operational conditions continue to affect the business whether or not they appear explicitly in the latest strategic objectives.

The connection between risk and objectives must therefore work in both directions. Strategic priorities should inform the way exposures are assessed and managed. Equally, information about those exposures should influence management's understanding of what the organization can achieve.

Katie put the problem sharply with an audience question. If two similar organizations suffer a major cyberattack, but only one has explicitly stated an information-security objective, the damage may be much the same. The omission does not make the exposure irrelevant. To my mind, an incomplete set of objectives is something to challenge, not a reason to disregard the exposure it leaves out.

Nor should an objective-centric approach become another isolated reporting exercise, detached from the people who understand the business's underlying financial and operational conditions. The specialists managing persistent exposures possess information that should contribute to strategic decisions. Management, in turn, needs to understand how those exposures affect the objectives it has established. We should be connecting the two, not replacing one disconnected collection of information with another.

Where to Start

Tim and Eileen placed their emphasis differently. Tim concentrated on securing leadership's commitment to overseeing uncertainty against mission-critical objectives. Eileen encouraged practitioners to begin demonstrating what more useful, objective-linked analysis could offer rather than waiting for ideal sponsorship, on the view that showing decision-makers something better can help build the demand for it.

I see value in both, and I would not collapse them into an easy agreement that better information automatically changes behavior. It does not. Boards and executives need to recognize their responsibility to demand candid information about uncertainty. Risk professionals also need to demonstrate that they can provide information worth demanding. One does not have to wait for the other.

A practical starting point might be an investment decision already approaching, an objective whose achievement is uncertain, or an existing treatment portfolio whose contribution has never been adequately examined. Show management what a more useful analysis could reveal.

Artificial intelligence may assist with some of the preparatory work. Eileen suggested using existing corporate information, including the annual report, to identify what appear to be the organization's most important objectives and to examine how current programs and treatments relate to them. That can be a useful starting point, provided we recognize its limitations. An AI-generated list of objectives is not an agreement between management and the board about what matters most, and the technology cannot determine which trade-offs leadership should accept. Those decisions belong to the people accountable for the organization.

Risk Management Belongs Where Decisions Are Made

I remain troubled by the way risk management is sometimes separated from the rest of the business conversation. An executive committee or board discusses strategy, investment, transformation, financial performance, and operational priorities. Risk management then appears as a distinct agenda item, often accompanied by its own reports and terminology. Yet uncertainty was present in every one of those earlier discussions. Why was risk intelligence not part of them?

During the webinar, I mentioned a conversation with a chief marketing officer whose organization's chief risk officer had never asked about marketing's risks, or even its objectives. The risk function was principally concerned with internal control over financial reporting. That is important work, but it is not the entirety of enterprise risk management. Marketing decisions involve uncertainty about customers, competition, investment, execution, and expected returns. So do decisions made in operations, finance, technology, and every other part of the business. A risk function that does not engage with those decisions is missing opportunities to contribute.

We should be asking executives what they are trying to achieve, how their performance is measured, and which decisions they are preparing to make. We should understand the assumptions behind those choices and help examine the possible consequences. That requires knowledge of the business, not merely familiarity with a risk methodology.

People already make decisions under uncertainty. They always have. Tim was explicit in distinguishing structured risk management from the intuitive, experience-based judgment that people already exercise: the purpose of a formal capability is to improve that process through more structured, informed, and disciplined analysis. If it cannot demonstrate that contribution, we should not be surprised when executives question its value.

What the Business Case Should Show

The business case for enterprise risk management should begin with something the organization needs to decide or achieve. Identify the objectives involved and the alternatives available. Examine the uncertainty associated with each and the resources each would require, drawing on relevant information from across the business, including what the specialists managing persistent exposures already know. Evaluate what different treatments or investments could accomplish and what uncertainty would remain. Then explain how that analysis should influence the decision, and who must make it.

Perhaps the analysis reveals that management's preferred strategy carries more uncertainty than the expected benefits justify. Perhaps it supports an investment that would otherwise have been difficult to defend. Perhaps it identifies a more effective combination of treatments, or demonstrates that an existing commitment should be reconsidered. The contribution may involve growth, efficiency, resilience, compliance, or the reliability of essential operations.

It will not always be possible to isolate a precise financial return from an improvement in decision-making. Nor should the value of risk management as a capability be confused with the measured results of any single treatment. A treatment can be judged by what it was expected to change and whether it changed it. The capability is judged by whether the organization decides better because of it, which no individual treatment's results can settle. We should nevertheless be able to explain what the analysis contributed, what assumptions supported it, and how the organization can assess the results.

This requires a change in how we present the value of our profession. The number of risks recorded is not the measure of success. Neither is the sophistication of the methodology, the completeness of the taxonomy, or the frequency of reporting. Those things may support effective risk management. They are not its purpose.

The organization has choices to make, resources to allocate, and commitments to fulfill, and uncertainty runs through all of it. Our responsibility is to help the people making those decisions understand their options, weigh the trade-offs, and recognize when the evidence calls for a change of course. Enterprise risk management earns its place in the business when it improves the decisions through which the business creates and protects value.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey