For many organisations, enterprise risk management still lives in a spreadsheet that is reviewed once a year, signed off, and quietly forgotten. That is a missed opportunity. Risk is not a compliance artefact — it is the language a board uses to talk about the future.

From register to conversation

A risk register is only as useful as the conversation it provokes. When we work with boards, the first change we usually recommend is to stop reporting risks as a static list and start reporting them as a set of decisions: what we are accepting, what we are transferring, what we are actively reducing, and what we have chosen to walk away from.

Define appetite before you measure exposure

Risk appetite is often written after the fact, in language broad enough to justify whatever the organisation was already doing. A useful appetite statement is uncomfortably specific. It names thresholds, it names owners, and it makes clear what happens when a threshold is breached.

• Financial: the maximum single-event loss the balance sheet can absorb without external funding.
• Operational: the longest tolerable outage for each critical process.
• Regulatory: the areas where the answer is simply zero tolerance.
• Reputational: the commitments the organisation will not trade away for margin.

Three questions every board should be able to answer

In our experience, boards that handle risk well can answer three questions without reaching for a document. What are our five largest exposures? Who owns each one? What would have to be true for any of them to become a crisis this quarter?

Making it stick

Governance changes fail when they add work without removing any. Retire the reports nobody reads. Fold risk into the papers the board already receives — strategy, capital allocation, major projects — rather than bolting on a separate agenda item at the end of a long day.

Done well, enterprise risk management does not slow decisions down. It gives a board the confidence to make bigger ones.