Boards spend a great deal of time discussing risk. In fact, they should, since investors expect it, regulators demand it, and management teams need a shared understanding of what could derail the business. Over the years, risk management has become more sophisticated. Registers are regularly reviewed, ownership is assigned, and dashboards track progress. On paper, it appears that every major risk has been accounted for.
Yet capable businesses still get caught by surprise. Not because they ignored a known risk. More often, because the risk they eventually faced was never recognised as a business risk when the original decision was taken.
That distinction is worth dwelling on.
A risk register is designed to capture what an organisation believes could go wrong. It is much less effective at capturing the assumptions on which those judgments rest. Those assumptions rarely appear in board papers as nobody owns them. They quietly become part of the backdrop against which strategy is discussed.
That is where I think boards have an often-underestimated role.
When management presents a strategy, the questions are usually familiar. Is the market large enough? Can we execute? Do we have the capital? What is the competitive response likely to be?
The harder questions are different.
What assumptions are we making about where this sector is headed?
Are institutions looking at this market in the same way they did three years ago?
Has public expectation changed, even if the law has not?
These are uncomfortable questions because they don’t always have precise answers. They demand judgment rather than certainty. They also force the conversation beyond quarterly targets and immediate execution.
One thing I have rarely seen is a business ignore a major regulatory development. Once a notification is issued or a consultation paper is released, organisations move quickly. Legal teams study the implications, public policy teams engage with stakeholders, and leadership begins asking what needs to change. That isn’t usually where businesses get into trouble. The more interesting question is whether they were asking the right questions before the issue became impossible to ignore.
But by then, the business is no longer making its first strategic decision. It is responding to one that has already been made for it.
Notifications rarely mark the beginning of a story. They usually mark the point at which everyone accepts that the story has already changed.
That is why I have gradually come to a different view of risk governance.
Boards should spend less time asking whether every risk on the register has a mitigation plan. They should spend more time asking whether the assumptions behind the register still deserve their confidence.
A risk register reflects what a business worries about. It also reveals what the business has stopped questioning.
Perhaps that is where the board creates its greatest value. Management is expected to identify and manage risk. The board has the distance to challenge assumptions that management, over time, has come to accept as fact. Those conversations are rarely comfortable. They are also the ones that often prevent the most expensive mistakes.
Before the next board meeting, it may be worth asking one question that never appears on the agenda.
What assumptions have we quietly accepted that no longer deserve our confidence?
The answer may not change the risk register.
It could change the business.
PB Lens
At PolicyBridge, we believe the most consequential business decisions are shaped long before they become regulatory issues. We work with founders, boards and leadership teams to understand how institutional thinking, regulatory direction and public expectations are evolving, so that strategy can adapt before change becomes disruption.