Why better risk visibility does not always lead to better board decisions
Boards now receive more risk information than ever. Dashboards are richer, risk packs are more sophisticated and oversight frameworks are more mature. Yet the uncomfortable question raised in the latest Risk Coalition Risk Mattersvirtual roundtable was whether this has really improved the quality of board decision making.
The discussion started with a provocation. Many boards do not primarily have a risk-visibility problem. In many cases, they receive substantial information about the organisation’s principal and emerging risks. The harder question is whether the governance system helps them convert that visibility into judgement, ownership and timely action.
In some organisations, more risk information has sharpened oversight. In others, it has created more discussion, more caution and more process comfort without making the decision itself any clearer.
This is the risk visibility paradox. Visibility is necessary, but it is not sufficient. A board can be well informed and still be poorly positioned to decide.
This is not an information-volume problem alone. Decision quality is produced by a wider governance system. Better information matters most when it is supported by clear framing, constructive challenge, effective chairing and disciplined follow-through.
When information does not create judgement
A recurring theme was that dashboards are instruments, not answers. They can show exposures, limits, breaches, trends, controls and stress indicators. They rarely answer the questions that matter most in the boardroom. What decision is required? What trade-off is acceptable? What is fact, forecast or judgement? Who owns the outcome? What happens if the board delays?
Several participants recognised the familiar problem of papers marked “for noting”. The phrase can look harmless, but it often signals a deeper weakness. If a matter is genuinely for noting, the board still needs to understand why it is being told and what, if anything, is expected to change as a result. If the paper is really seeking challenge, advice, escalation or approval, that should be explicit. Otherwise, the board may become part of a ritual in which management has technically informed directors, but no one has clarified what judgement is required.
The lesson is not that boards need less information in every case. It is that they need information that is sufficient and decision-useful. A good paper should expose the decision, clarify the options, identify the trade-offs, connect the matter to risk appetite, state key assumptions, assign ownership and define what would trigger escalation or later review.
The missing discipline of “so what?”
One of the simplest challenges discussed was also one of the most powerful. Boards should be more willing to ask: “So what?”. What does this information mean for the organisation? What changes because the board has had this discussion? What is the consequence of doing nothing?
This matters because board conversations can be active without being effective. A committee may spend half an hour discussing an issue, refine the language, request more analysis and move on without ever closing the loop. The meeting has been busy. The minutes may record challenge. Yet the outcome is unclear. No owner has been named. No deadline has been set. No threshold for escalation has been agreed.
This is also where the Chair’s role becomes critical. An active discussion is not necessarily a resolved one. Before the item closes, the Chair should make clear what has been decided, what remains open, who owns the next action, when it is due and what would cause the matter to return. Management should not be left to infer the Board’s position from the mood of the room.
Decision discipline requires boards and committees to be clear about their role in each item. Are they there to decide, advise, challenge, assure, escalate or delegate? These are different activities. Confusing them weakens accountability. It can also blur the relationship between the board and its committees. A risk committee may test the quality of the framework, the adequacy of controls and the logic of escalation. The full board may retain responsibility for appetite, strategy and major reserved matters. Both need clarity about where judgement is shaped and where decisions are actually taken.
Decision discipline does not mean that the Board takes on management’s responsibilities. It means each forum is clear about whether it is deciding, advising, challenging, assuring, escalating or delegating. Reserved decisions remain with the Board. Delegated decisions remain with committees or management operating within a clear mandate.
Risk appetite must be connected to real choices
The roundtable also challenged the way risk appetite is often used. Appetite is too often reported, observed or appended to papers, rather than actively used to shape the decision. It should help boards navigate real trade-offs. Growth and resilience. Innovation and control. Client service and conduct. Liquidity and profitability. Local priorities and group priorities. Regulatory confidence and commercial pace.
Participants also emphasised that risk should not be treated only as a defensive activity. Risk management should help the organisation achieve its objectives and take the right amount of the right risk, not simply prevent adverse events. Reporting should therefore connect risk and uncertainty to mission-critical objectives, rather than organise every discussion solely around categories of risk. Otherwise, the Board receives a list of what might go wrong, rather than an assessment of the choices that will increase or reduce the likelihood of strategic success.
Foresight, blind spots and the limits of process
A strong theme was that boards are often better at hindsight and insight than foresight. Risk reports can become backward-looking, internally focused and over-dependent on familiar tools. Heat maps, registers and dashboards may create a sense of order, but they can also encourage false precision.
The risk that crystallises is often not identical to the risk originally described, particularly where circumstances, transmission channels and management responses change over time.
The discussion highlighted the need for boards to spend more time looking through the windscreen, not just debating the colour of last quarter’s risk rating. They need to ask what could change next, how quickly and with what consequences.
Velocity matters. Some risks move slowly and give organisations time to respond. Others move quickly and require boards to understand in advance what would trigger action. This is where escalation thresholds, early warning indicators and scenario thinking become important.
Blind spots also came through strongly. Boards need enough knowledge to govern risk in areas of disruption, such as artificial intelligence, cyber, geopolitical instability and new technology. They also need the humility to recognise where they do not know enough. This is not simply a matter of individual training. Boards should assess the skills and perspectives they need for their specific context, then invest in development accordingly.
Better tools will not fix weak conversations
Artificial intelligence featured as both an opportunity and a caution. It may help boards and risk functions connect risks, controls, obligations and objectives more effectively. It may reduce time spent compiling reports and increase time available for analysis. It may also help organisations identify patterns and drivers of variability that would otherwise be missed.
But better tools will not automatically create better governance. If the underlying conversation is weak, technology may simply industrialise the weakness. A risk register can be a useful component of a risk framework, but it should not become the purpose of the framework. One participant captured the point well by asking whether the risk register is a kite or an anchor. Used well, it can help the organisation fly. Used mechanically, it can become an anchor.
The same applies to board papers, dashboards and risk appetite statements. Their value lies in the quality of the conversation they enable. Risk management, at its best, is not a cycle, a template or a system. It is a good conversation embedded in strategy and decision making, with clear accountability for what happens next.
Five questions for decision-useful risk governance
The roundtable pointed to a practical discipline that boards and management teams can adopt. For any material risk item, five gateway questions can help shift the conversation from visibility to judgement:
What decision, if any, are we being asked to make?
What does our appetite permit, constrain or require?
What are the consequences of delay?
Who has authority, and who owns execution after the meeting?
What would cause us to revisit the decision?
These are not intended to be another long checklist. They are gateways. If a paper cannot answer them, the board should question whether it is ready for discussion.
A practical starting point would be to place these five checkpoints on the first page of every material Board or committee paper. The aim is simple. Directors should understand the decision, authority, timing, ownership and route back to the Board before they enter the supporting detail.
The real measure of risk governance
One of the clearest conclusions emerging from the discussion was that better risk governance is not measured by the volume of reporting. It is measured by whether reporting supports sound judgement, clear authority, accountable action and organisational learning.
Boards do not exist to eliminate uncertainty. They exist to govern the organisation’s response to it.
That requires focus. Boards and committees cannot give equal attention to every risk. They need to identify the matters where their judgement is most needed, be realistic about what should be delegated and ensure that delegated matters are governed through clear expectations and feedback loops. They also need to review the quality of past decisions, not just the status of current risks.
That review should distinguish decision quality from eventual outcome. A reasonable decision may still produce an adverse result. The Board should therefore ask whether the issue was properly framed, whether the available information was sufficient, whether material assumptions and alternatives were tested, whether authority was clear and whether execution followed the agreed conditions.
The practical challenge is simple to state and difficult to do. Boards need to move from being better informed to being better prepared to decide. That means fewer ritual conversations, sharper papers, clearer decision rights, better use of appetite and a stronger link between risk, objectives and strategy.
The most effective boards will not be those with the thickest risk packs. They will be those that use risk information to ask better questions, make clearer choices and learn from the outcomes. In uncertain times, that is where risk governance earns its place.
Chris Burt is a Principal at Halex Consulting, a leading boutique governance consultancy specialising in independent board performance reviews and risk management advisory services. He is also a co-founder of the Risk Coalition and principal author of the Risk Coalition’s internationally acclaimed, Raising the Bar leading practice guidance for board risk committees, and its recently published Raising your Game cross-sector leading practice guidance for boards and committees. www.linkedin.com/in/chrisjburt
Espedito Peluso is a senior financial services risk and governance leader, with experience across regulated international banks and securities firms. He has chaired board-adjacent and board-equivalent committees covering credit events, complex transactions, stress testing, new business and crisis governance. He is a qualified accountant and holds an MBA, an MSc and the FT Non-Executive Director Diploma. www.linkedin.com/in/espedito-peluso