Decision-Focused Risk Management Sounds Good, but Do CEOs & Boards Really Want It?

A new wave of professionals is transforming Governance, Risk, and Compliance from a rigid framework into a dynamic force for trust, innovation, and resilience. Governance, Risk, and Compliance (GRC) has long been associated with boardrooms and bureaucracy—a domain reserved for executives and auditors. But that image is changing fast.

It's planning season for many risk management and internal audit functions. CROs and CAEs are deciding where to spend their limited resources, what work to prioritize and what they hope to accomplish in the coming year. I have a question for them. Do you see yourselves in the decision and performance support business?

There is growing support for the proposition that formal risk management should focus on helping organizations make better decisions, rather than maintaining risk registers and reporting management's control deficiencies. I agree with that direction, but with some fairly substantial caveats. For starters, which decisions?

Organizations make tens of thousands of decisions every year. Applying formal risk management to all of them would be absurd. Applying it to every decision where management might appreciate some assistance would still be impractical, costly and unnecessary. So we need to be selective. But selective on what basis?

My preference is to start with OBJECTIVES, not risks. More specifically, identify the MISSION CRITICAL OBJECTIVES that are most important to sustained organizational success. These should include the organization's most important strategic, value creation and value preservation objectives.

Then decide how much risk assessment rigor each warrants. Not every objective requires the same expenditure of time, resources or analytical sophistication. Some deserve a great deal. Others don't.

Once those judgments have been made, identify the major decisions that could materially affect achievement of those objectives. The job of formal risk management should be to help management develop sufficiently reliable, balanced information on PERFORMANCE, RISKS, OPPORTUNITIES, CURRENT RISK TREATMENTS and UNCERTAINTY.

That information should help management make better decisions. It should also give boards a sounder basis for assessing whether management's plans and actions are likely to achieve the results being sought.

I would add something that is frequently overlooked. Deciding to leave existing risk treatments unchanged is itself a decision. It may be an invisible one, made without a meeting, formal approval or even much conscious consideration. But if the objective is important and circumstances have changed, the consequences of doing nothing can be substantial.

This is why I believe the starting point matters so much. If we start with risk registers, we tend to spend our time discussing risks. If we start with mission-critical objectives, we have a better chance of identifying the decisions, uncertainties and risk treatments that deserve serious attention.

None of this strikes me as particularly controversial. The real difficulties begin when we ask whether CEOs and boards actually want the information such an approach might produce.

The Don't Tell/Don't Ask Governance Syndrome

Consider a CEO who has committed considerable personal and organizational capital to an acquisition, major investment, transformation program or ambitious growth strategy. Would that CEO welcome a rigorous, balanced assessment showing that the chances of achieving the promised results are substantially less certain than previously represented? Would the CEO willingly provide that assessment to the board, particularly if it challenged assumptions underlying a favored strategy or raised questions about decisions already made?

Perhaps. Some would. But how many? And how many boards would insist on receiving such an assessment, particularly when doing so might require them to challenge a CEO whose judgment they have generally trusted? These are questions the risk management profession needs to spend more time examining.

I call the problem the DON'T TELL/DON'T ASK GOVERNANCE SYNDROME. Management doesn't volunteer sufficiently balanced information about the risks and uncertainty surrounding important objectives and decisions. Boards don't insist on receiving it. Risk management and internal audit functions often don't challenge the resulting information gap.

Instead, the familiar machinery continues. Risk registers are updated. Control weaknesses are documented. Audit findings are reported. Committees receive their papers.

There may be a great deal of activity, much of it useful, without anyone seriously examining whether the organization's most important objectives are likely to be achieved. I am not suggesting that risk registers, internal controls or traditional assurance work have no value. They do. But their existence should not be confused with effective risk governance.

A board can receive extensive information about individual risks and control deficiencies and still have an inadequate understanding of the uncertainty surrounding the objectives on which the organization's future depends.

That should concern directors far more than whether the latest risk register has been updated on schedule. It should also concern CROs and CAEs who believe their functions are contributing to better decisions.

Are We Prepared to Challenge the Information Gap?

Moving into the decision and performance support business requires risk and audit functions to reconsider what they are trying to accomplish. For risk management, the question should be whether management has sufficiently reliable information about the effect of uncertainty on mission-critical objectives and the options available to improve the likelihood of success.

For internal audit, it should include whether the processes used to generate and report that information are reliable, whether important assumptions and risk treatments have been adequately assessed, and whether significant gaps in information are being brought to the attention of those responsible for oversight.

The two functions have different mandates. Neither needs to assume management's responsibility for making decisions. But both can contribute to the quality of information on which those decisions depend.

And both need to recognize that reporting an information gap may be considerably more uncomfortable than reporting a conventional control deficiency. Imagine telling a board that management has not provided a sufficiently balanced assessment of the uncertainty surrounding a mission-critical objective. Or that the evidence available does not support the degree of confidence being expressed about a major initiative.

That is a different conversation from reporting that a control was not operating as designed. It is also a conversation that some executives may have little interest in encouraging. Which brings us back to planning season. Before CROs and CAEs commit their resources to another annual program of risk assessments, audits and reporting, I think they should be asking some fairly direct questions.

Has the organization identified its mission-critical objectives? Has anyone consciously decided how much risk assessment rigor those objectives warrant? Are the major decisions affecting their achievement receiving appropriate attention?

And, most importantly, are the CEO and board prepared to receive balanced assessments of performance, risks, opportunities, current risk treatments and uncertainty, including when the findings challenge decisions they have already made or strategies they strongly support?

If the answer to that last question is no, we have a problem that no amount of methodology refinement is going to fix.

The profession can develop better frameworks, more sophisticated analytical techniques and more elaborate reporting systems. It can embrace new technology and promise more timely insights. None of those advances will accomplish much if the people responsible for corporate governance are unwilling to confront what the information reveals.

This is especially troubling given the duty of care expected of boards. How can directors exercise effective oversight of an organization's most important objectives without sufficiently reliable, balanced information about the prospects for achieving them?

I think that question deserves a much more prominent place in discussions about the future of risk management and internal audit.

My new book, Mission Critical Governance: Focusing on What Matters Most, examines these issues in detail and proposes ways organizations can improve governance by concentrating resources and attention on what matters most.

I believe there are practical ways forward, where the will exists. What I am considerably less certain about, even after exploring the subject with the help of my AI research assistant, is how widespread that will really is. Perhaps that is the most important question CROs, CAEs, CEOs and boards should be asking themselves as they prepare for another year.