Managing Risks During Strategy Changes

Lost in Translation: When Project Risks Fail to Shape Strategic Decisions   Why do many strategic initiatives unexpectedly underperform even in organizations with mature risk management?   Many organizations tell me they manage risk enterprise-wide. Still, many strategic initiatives fail in ways that, in retrospect, seem obvious. This is rarely due to insufficient documentation or a lack of risk awareness. More often, it is a structural issue in how uncertainty is framed, divided, and managed across strategy and execution.   Corporate Risk Management and Project Risk Management are typically treated as two separate disciplines. This division appears sensible and is deeply embedded in risk management standards, organizational structures, and academic research. But it is not ideal.   Strategy, more often than assumed, fails in execution. In many companies, execution today is primarily driven by projects. Usually, these projects are the primary carriers of a company’s uncertainty. Yet in many organizations, project risks are managed locally, whereas enterprise risk management largely ignores these risk carriers.   Risk management typically operates using aggregated risk categories (see my earlier post), often paired with weak risk appetite statements and company-level scenarios. Project Risk Management, by contrast, works with concrete delivery risks, contingencies, and buffers. Each perspective is internally coherent. But without a clear connection between the two, uncertainty becomes fragmented.   The consequences are subtle, often unnoticed, yet significant. Risk appetite becomes a decoration rather than a constraint that is actually tested through execution. Projects are optimized individually, whereas portfolios become collectively risky. Early warning signals emerge at the project level but do not inform strategic decision-making.   This is not due to a lack of professionalism. It is a structural outcome of how risk management has differentiated itself over time. Separate languages, tools, education, consulting, and responsibilities make it difficult to maintain coherence across levels.   Reconnecting the two disciplines does not require new frameworks or more reporting. It starts with a shift in perspective. Major projects must be understood as carriers of key risks. Risks should be aggregated where projects interact. And signals from project execution must be translated into thresholds that inform strategic decisions.   Every strategic decision is a bet on an uncertain future. Risk management exists to improve those decisions. When uncertainty is fragmented along organizational or methodological lines, risk management risks losing sight of its own purpose.   Where do you see the biggest disconnect between strategic risk and project execution? Institut für Finanzdienstleistungen Zug IFZ Lucerne University of Applied Sciences and Arts

15+ years in risk management, 8 of them as CRO at Allianz and MetLife, taught me one thing 👇 The risk management most companies practice today is broken. Registers. Heatmaps. Quarterly reviews. Lists of bad things that might happen. It generates documents. It does not change a single decision. RM2 starts from a different question: which uncertainties stand between us and our strategic objectives, and how do we decide inside that uncertainty? 🎯 10 steps to move from RM1 to RM2: 1️⃣ Begin with objectives. Define 5 to 7 strategic objectives for the next 18 to 36 months. A risk is an effect of uncertainty on one of them. 2️⃣ Build a decision inventory tied to those objectives: capital allocation, M&A, new products, market entry, partners, executive hires, technology bets, crisis response. Anchor it in a board-approved Delegation of Authority. 3️⃣ For every material decision, look at uncertainty in both directions. Downside AND upside. A one-sided view is a half-finished view. 4️⃣ Quantify whenever you can. Distributions, ranges, probabilities. Qualitative only when data genuinely does not exist. 5️⃣ Approve a Risk Appetite Statement at board level, tied to objectives. Build the full cascade: capacity, appetite, tolerance, limit. Each layer in numbers. 6️⃣ Kill the heatmap. Replace it with scenario simulation showing probability distributions of P&L, capital, liquidity, and reputational impact for every material decision. 7️⃣ The decision-maker is the risk owner. The risk function challenges and provides methodology. 8️⃣ Build KRIs from objectives downward, not risks upward. Each indicator: which objective it serves, threshold for action, owner, escalation path. 9️⃣ Run pre-mortems before material decisions and structured reviews after them. Capture assumptions, ranges, early signals, mitigations. 🔟 Audit decision quality, not outcomes. Frame, alternatives, information, values, reasoning, commitment. A good outcome can hide a poor decision. Done properly, risk management is how organisations make better decisions under uncertainty. 💬 Is your company managing a risk register, or already managing decisions under uncertainty? 📌 Save this for your next strategy session. 🔄 Repost if your leadership needs to see this. P.S. Comment "RU" 👇 and I will send you private access to my Telegram channel Risk University. RM2 frameworks, board case studies, and lessons from 15+ years in risk management. Serious practitioners only. #RiskManagement #RM2 #Governance #DecisionMaking #CRO #EnterpriseRiskManagement #RiskUniversity

Strategy is not the plan an organisation executes. It is the decisions leaders make as conditions change. The risk is mistaking constant adjustment for strategic adaptation. The operating environment is changing fast. Teams respond quickly to what is happening around them. Forecasts are updated. Resources are reallocated. Timelines are revised. Priorities are adjusted. Overall, this looks like responsiveness. But there is a another possibility. A silent risk that everything around the strategy keeps changing, while the strategy itself is not re-examined. A customer shift becomes a sales adjustment. A competitor move becomes a pricing response. A technology change becomes an efficiency initiative. A demand change becomes a revised forecast. The responses are rational. But one after another, those rational adjustments pull the plan further away from the strategy it was meant to execute. And a gap opens. Not because of a single bad decision that can be isolated and corrected. But because of the accumulated distance between the strategy leaders believe they are executing, and the plan the organisation has gradually adapted into. The problem appears when the same kind of adjustment keeps recurring, and no one asks: Are we still adapting the plan to serve the strategy? Or are we using the plan to avoid questioning whether the strategy still holds? That is where anticipation has to operate. Not only at the level of results. Not only at the level of plans. But at the level of the assumptions that decide what the organisation is willing to question. Because sometimes adaptation is not proof of strategic agility. Sometimes it is how an outdated strategy survives. Look at the adjustments your organisation has made more than once this year. Then ask: are they keeping the strategy alive, or are they quietly showing that it needs to be re-examined? Follow Sharon Greene for more on strategic anticipation, and future-ready decision-making creating your Anticipation Advantage.

If your CRO challenged your last major strategic decision, would the Board treat that as value creation or as a problem to be managed? The question came from a frustrated CRO who has just been excluded from yet another "urgent" strategy session. His concern was not about being left out; it was about watching his organisation make decisions that fundamentally contradicted their own risk appetite statements while the board remained blissfully unaware of the disconnect. His question highlighted the fundamental misconceptions many boards have about the connection between strategy and risk oversight. Most often, directors tend to treat their CRO's concerns like unwelcome interruptions to an otherwise smooth strategy presentation, a fundamental misunderstanding of what effective risk governance actually requires. Risk is not the enemy of strategy; it is the lens through which sustainable strategy gets refined. My CRO friend also shared the experience of how he worked with a board pursuing an exciting expansion opportunity that appeared commercially compelling. Only later did it become clear that regulatory exposures had been underestimated. Risk concerns had surfaced early but were viewed as obstacles rather than strategic intelligence. The eventual correction was costly and avoidable. I have found that the real test of board maturity is not how directors respond to success stories, but how they react when uncomfortable questions are asked about popular initiatives. Do they lean in with curiosity or lean back with defensiveness? Do they explore the implications, explain them away or allow management to explain them away? Risk-mature boards, on the other hand, tend to behave differently. They integrate risk insight at the beginning of strategic conversations, not at the end. They treat the CRO as a strategic partner, not a procedural checkpoint. They recognise that the greatest risks often sit inside their strongest assumptions. However, this will require boards to model intellectual humility about uncertainty because when directors acknowledge what they do not know, they create psychological safety for others to surface uncomfortable truths. The practical application of this will require boards to: ▶schedule strategy sessions that begin with risk context rather than end with risk compliance, ▶create direct communication channels between risk functions and board committees that bypass management filters, when necessary, ▶invest in their own risk literacy through ongoing education rather than relying solely on management briefings.   The CRO's challenge to strategic decisions is not a governance problem to be managed. It is governance intelligence to be leveraged. The question is whether the board has the maturity to recognise the difference. #CorporateGovernance #RiskGovernance #BoardEffectiveness #StrategicRisk 

Every banking crisis reinforces the same lesson. Risk belongs in the boardroom long before it appears in an examination report. Over four decades in banking, I have learned that institutions rarely fail because they lack risk reports. They struggle because risk remains disconnected from strategic decisions. Today's environment makes that gap even more expensive. Regulators continue to highlight commercial real estate exposure, operational resilience, third party dependencies, evolving fraud, and technology related risks as supervisory priorities. These are not isolated issues. They influence capital allocation, growth strategy, acquisitions, and long term competitiveness. The strongest leadership teams approach enterprise risk management differently. Before approving a strategic initiative, they ask a simple question. What assumptions must remain true for this decision to succeed, and what early signals tell us those assumptions are changing? That shifts risk management from documenting yesterday's exposures to improving tomorrow's decisions. Enterprise risk management delivers its greatest value when it shapes strategy before uncertainty becomes loss.

Risk Management Made Simple: A Straightforward Approach for Every Project Manager Risk management is crucial to project success, yet it's often seen as complex and intimidating. Here’s a simple approach to managing risks in your projects: 1/ Identify Risks Early: → Start with a risk brainstorm: technical, operational, financial, and external risks. → Collaborate with your team to identify potential threats and opportunities. → Involve diverse team members to gain different perspectives on possible risks. → Use historical data and past project experiences to spot risks that may arise again. 2/ Assess and Prioritize: → Use a risk matrix to assess impact and likelihood. → Prioritize high-impact risks that could derail your project’s success. → Make sure you reassess risks periodically to capture any changes in impact or probability. → Don’t forget to consider opportunities as well—these should be prioritized, too! 3/ Develop Mitigation Plans: → For each priority risk, develop a strategy to minimize or avoid it. → Plan for contingencies to stay prepared for the unexpected. → Ensure the mitigation plans are realistic and actionable. → Set up early-warning systems so you can act quickly if needed. 4/ Assign Ownership: → Assign a team member to own each risk, ensuring accountability. → Ensure they track progress and adjust strategies as necessary. → Empower the risk owner with resources and authority to implement mitigation plans. → Ensure a straightforward escalation process if the risk owner needs help. 5/ Monitor and Update Regularly: → Schedule regular risk reviews and status updates. → Keep an eye on emerging risks and adjust plans as your project evolves. → Maintain an open feedback loop with stakeholders on the evolving risk landscape. → Use project management tools to automate risk tracking and reminders. 6/ Communicate Effectively: → Keep stakeholders informed about risk status and changes. → Be transparent about potential impacts and solutions. → Ensure communication is clear and consistent across all levels of the team. → Adjust your communication style based on your stakeholders' needs and preferences. Managing risk doesn’t have to be complicated. Focus on 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝘆𝗶𝗻𝗴, 𝗽𝗿𝗶𝗼𝗿𝗶𝘁𝗶𝘇𝗶𝗻𝗴, and 𝗮𝗰𝘁𝗶𝗻𝗴 𝗲𝗮𝗿𝗹𝘆; you'll set your project up for success. What’s one risk management tip you live by? Let’s share some wisdom!