---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

Cultural Resistance to Risk Thinking

There are cultures inside companies that treat risk like a taboo subject. Not because anyone decided it should be that way, but because years of process, compliance, audits, and defensive behavior trained people to believe that anything related to risk is negative. If the standard created years ago framed risk conversations as corrective or punitive, then people will naturally defend against it. When a person is called a risk owner, the label alone creates tension. It sounds like they are being assigned blame for something they did not do. And once someone is told they must meet with ERM to discuss how they will mitigate or minimize or reduce a risk, they are already on the defensive. They walk into the room prepared to justify actions rather than explore uncertainties. They feel like they are meeting with someone who is ready to judge them. No one enjoys conversations that feel like that. So people withdraw and hide.

If risk is framed as an exercise in reduction or control, then of course people see it as negative. No one wants to spend time with someone who appears to be looking for flaws or mistakes. What we should be doing instead is collaborating. We should recognize that risk work is not about forcing processes on people but about supporting the people who make decisions. We help them gather meaningful information. Not all information, but information that provides insight into uncertainties and reveals signals and drivers that shape the future. We help them interpret what they see. We help them step into decisions with a clearer view. That does not guarantee every decision will be right, because the world changes too fast for that, but it does mean they move forward with both eyes open. Clear vision beats a blurry view every time. No one chooses to see the world through a foggy lens when clarity is possible.

 

The Roots of Resistance

In many companies there is an unwritten rule that says do not bring me problems. Most executives operate in an environment of pressure. Increase revenue. Increase visibility. Deliver growth. Raise shareholder value. Expand influence. Keep the momentum moving up and to the right. They focus on creating value because creating value feels more exciting than protecting value. A former CFO I worked with once said that a strong executive understands value creation and value protection, but the truth is that one is rewarded more often and more visibly than the other.

If someone told you that you could raise revenue from ten billion to eleven billion, you would find that idea appealing. If someone told you that you must reduce a five billion cost base down to four billion with fewer resources, you might feel miserable before you even start. One feels like opportunity. One feels like punishment. Most companies lean heavily on negative consequences. Provide less. Take away. Restrict more. Positive reinforcement is far less common.

People also fear being judged. They fear that speaking openly about uncertainty will be interpreted as incompetence. They fear that admitting what they do not know will slow their career. Society celebrates the person who succeeds after twenty failures, but no one celebrates the person who is still failing. We create myths about persistence and brilliance. Sometimes the person who succeeded on the twenty first try simply got lucky. Society does not want to hear that version of the story. So inside companies people hide. They avoid any label that feels like failure. They protect themselves because survival feels safer than honesty.

 

What Leadership Signals

Leadership behavior sets the tone for how risk is perceived. If a leader does not want to discuss risk, the team will not want to discuss it either. They read the facial expressions and hear the tone shift. They feel the tension when a risk topic lands on the table. If a leader claims risk matters but punishes candor, people become silent. They begin to distance themselves and allow someone else to speak first. They avoid accountability by creating so many participants that no one can pinpoint responsibility. Leaders don’t want to hear about trying to solve a risk that will take considerable amount of money. Especially when they are attempting to create 5%, 8%, 12% growth and risk discussions detract from the time to discuss how to make more money.

Often the behaviors that suppress open conversation are not subtle. They are visible to everyone. A raised eyebrow, a bored expression, arms crossed, a dismissive comment. When a leader treats risk as bad news, ERM becomes the bad news department. And who wants to spend time with the group that brings the dark cloud to the meeting.

Part of the issue is that ERM professionals have allowed themselves to operate inside that frame. If we know that leaders dislike downside conversations, then we should not cling to a framework that focuses only on downside. We should expand the narrative and shift from talking about outcomes to talking about decisions. We should position ourselves as partners who help illuminate uncertainties, reveal opportunities, and widen the field of view. Our value should come from helping decision makers think better, sooner, and with a broader lens.

 

The Cost of Silence

Burying risk always has a cost. Signals accumulate, conditions form, and maneuverability disappears long before the crisis arrives. Imagine a small crack forming inside a structure. At first it is almost too small to see. A hairline fracture, but a signal. If it is ignored, the crack grows and pressure builds. The structure weakens and then one day it fails and everyone is shocked, even though the early signs had been visible for years.

Weak signals are opportunities. They are warnings that still allow room for revision, deviation, or at least preparation. When those signals are suppressed, the organization trades early options for late consequences. Think about the 2008 Global Financial Crisis. Signals existed and warnings were present. But overconfidence and lax oversight turned signals into silence. When the collapse came, it was not because the signals were too faint but because leaders did not listen.

There is also an emotional toll when people know it is not safe to speak. It does not take long before they stop speaking to protect their standing. They fear the label of negativity or appearing pessimistic. They fear the consequences of surfacing something unpleasant. They want to be recognized as high performers, and they believe that bringing problems forward will make them look weak. Instead, they hide what they see, even when they know silence carries risk.

Decision portfolios become distorted and choices are made based on curated narratives rather than real insight. People begin to craft stories that sound clean because clean stories gain approval. Uncertainties are omitted, ambiguities are eliminated, and interpretations are softened. The result is a portfolio built on incomplete truths. Some organizations do not fail because the world was too complex but because no one felt safe enough to reveal the complexity.

History is full of examples where silence did more damage than complexity. Volkswagen. Boeing. Situations where concerns were raised yet kept quiet. When cultures punish honesty, the truth finds the darkest corners to hide in.

 

The Shape of Curiosity

Healthy curiosity is rarely found inside cultures that resist risk conversations. True curiosity is uncomfortable because it surfaces questions no one wants to answer. But when curiosity thrives, organizations become more agile. They see and anticipate more while adjusting before they are forced to adjust.

Curiosity looks like someone willing to take the contrarian view. It looks like the tenth person in the room asking the question no one wants to ask. It looks like someone connecting two unrelated signals and creating insight. It looks like someone interpreting uncertainty with humility rather than trying to prove they are the smartest in the room.

There is a difference between performing curiosity and living it. Many companies claim they encourage open dialogue, but the behavior does not match the message. Real curiosity looks like a leader who listens and genuinely wants the team to challenge ideas. It looks like a team that feels safe enough to say the uncomfortable thing. It looks like a culture where someone can admit they missed something and not fear punishment.

Psychological safety does not need academic language. Having comfort that if you speak up, you will not be punished is plain enough. The knowledge that mistakes will not define you and curiosity will not be punished is simple. But for curiosity to become cultural, leaders must model it. They must allow their own ideas to be challenged and admit their own uncertainties. They must acknowledge that success often comes from luck, timing, and the contribution of others, not just their own brilliance.

Curiosity seems to be inverse to ego. As the ego grows, curiosity starts to die. The circle is complete when ego creates the narrative that the only creativity which can be trusted is your own. But it thrives when leaders drop the performance and become human again.

 

Turning the River

Think of a river that flows freely. It feeds everything around it. It creates life. Ideas and conversations behave the same way. When the river branches, new life follows. That is what happens when curiosity spreads through a culture. But when the water is blocked, everything begins to dry out. Progress slows, the current becomes stagnant, and life disappears.

Cultures block the river when they punish honesty or encourage people to protect themselves. Once the river dries, bringing it back requires more than a workshop. It requires the consistent behavior of leaders who show that speaking honestly is not a trap. It requires routines that encourage exploration. It requires questions that challenge assumptions. It requires spaces where people can say what they see without fear.

Small changes matter. A leader who shares a mistake openly. A team member who asks a thoughtful question. A meeting where someone says what everyone else is thinking. These are signals the river is moving again.

 

The Message Beneath Everything

Cultural resistance to risk thinking has very little to do with tools. It has everything to do with trust. Risk thinking is not negative, it is stewardship. It is curiosity about what might come. It is openness to the pressures people feel and the uncertainties that shape decisions. It is the willingness to look ahead without pretending the path is certain.

An organization succeeds not because it avoids all mistakes but because it chooses to see the future with honest eyes. When cultures embrace uncertainty rather than fear it, decision making becomes clearer, faster, and more grounded. The goal is not simply to reduce or mitigate. The goal is to help people step into the future with meaningful information that strengthens their choices.

Success comes when curiosity becomes natural. When speaking up becomes safe. When truth finds daylight instead of shadows and when the river flows again.

If that can happen, cultural resistance fades. And risk thinking becomes what it always should have been. A way to see the world clearly and a way to help people make better decisions. A way to navigate an uncertain future with both eyes open looking upon the wonderful flowing river.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

Death by Survey: When Risk Registers Stop Breathing

There is a story every risk professional knows far too well. It begins with the hopeful planning phase, the place where an ERM leader decides that this year will be different. They sit at their desk and dedicate hours to shaping what they believe will be the perfect risk survey. They pour themselves into every question, refine the wording for clarity, build in context so participants know what is being asked, and imagine a future where leaders across the organization respond with deep insight and fresh thinking. After weeks of careful preparation, the survey is finally ready. They prepare the announcement, remind teams of its importance, and send it out into the world expecting it to return carrying the wisdom of the business.

In this dream the responses roll in steadily. Executives write with richness and detail. New emerging risks appear that broaden the horizon of what the company should anticipate. Existing risks come with fresh information that changes their place in the portfolio. When the ERM leader compiles the results they see a vibrant ecosystem with dozens of risks with thoughtful owners identified across the business. The follow-up workshops are full of people who are engaged and ready to refine the register even more. The whole system feels alive. It would be amazing if it actually happened that way.

The reality is far less miraculous. The same ERM leader still spends countless hours preparing the survey but once it is released the participation rate hovers at fifteen to twenty percent. Instead of rich insight the answers look almost identical to last year and the year before that. The few people who do respond appear to be recycling the same thoughts and the same scores. If there were a button that said “same” many of them would have pressed it without hesitation. By the time the follow-up workshop arrives most attendees have already checked out. They sit politely, waiting for the meeting to end so they can get back to something that feels more productive. This is the status quo of risk surveys as they exist in many companies today.

 

It is not difficult to illustrate why. Most people receive surveys everywhere they go. They get associate engagement surveys at work and pulse surveys throughout the year. They get end of call surveys when they speak with customer service. They get marketing surveys from companies wanting feedback on their latest push notification. None of these feel meaningful because they rarely lead to visible change. Compare this to the types of surveys people are excited to complete. Product design surveys. Early concept feedback surveys. Planning and development surveys where they can influence something they care about. Participation is high in those because people feel connected to the outcome. Risk surveys, by contrast, are often just another inbox item. They feel like a duty rather than a dialogue.

This is where the metaphor of photography becomes useful. Imagine a photographer who carries a beautiful analog camera into the mountains. They wait patiently for the perfect moment when the river cascades over the boulders, the light angles just right across the landscape, and the scene feels alive. They take photo after photo believing the results will be extraordinary. When they return home they discover that a smudge on the lens ruined everything. Or they failed to put the film in correctly. Or their finger drifted into the frame. Maybe a butterfly flew across the shot or a hiker wandered into the background munching messily on a granola bar. The photographer had good intentions and tried to capture reality but the result is still unclear. Surveys operate the same way. They try to capture a moment in the business but they miss the movement, the interruptions, and the shifting terrain. The static photograph quickly becomes an artifact rather than an accurate representation of reality.

 

The deeper truth is that companies rely on surveys for the same reason airlines continue to board passengers from the front even though boarding from the back is more efficient. People repeat what they have always done because it feels familiar and comfortable. It is not that surveys are useless. They can be valuable when used with intention. The problem is that many risk surveys are built from the same page of the same old book, a book that has long been forgotten on a high shelf. They stop being tools for insight and become rituals that survive out of tradition.

Even in the rare cases where a survey launches with strong engagement the energy fades across each annual cycle. Within a few years the risk register hardly changes at all. Risk owners write the same descriptions they wrote previously. They keep the same scores because nothing dramatic has happened to convince them otherwise. Mitigation plans remain consistent. The register becomes a mirror of itself, an endless loop of sameness that resembles an associate engagement survey where everyone fills it out hoping for change but nothing ever truly shifts. Some risks, such as geopolitical instability, cyber concerns, or supply chain volatility, naturally stay on the list year after year. They are real and persistent. Yet even these have depth and complexity beneath the surface that static surveys rarely explore. It is like looking at a calm lake and believing the water is quiet simply because the surface is smooth, while under the surface entire ecosystems are shifting.

The result is a list of recycled risks. They are familiar, predictable, and comfortable. They also give a false sense of security. People answer based on what they think leadership expects to hear, rather than what the signals around them are actually telling them. Managers check boxes instead of uncovering new and meaningful insights. It is similar to our trips to Big Sky, Montana. We used to go to Big Sky each year and cross-country ski. It was a quaint little town with many like-minded enthusiasts that enjoyed skiing in the mountains. The second year it shifted, and the year after, and the year after. Before we knew it, national chains moved in, like-minded people became those who believe taking a picture of the snow and mountain is more fun than going out and experiencing it. Times shifted and we no longer fit with what Big Sky had become. But our picture of Big Sky in our heads remained the same, in a past that no longer existed in the present.

 

This static approach has real consequences. By the time the survey is distributed, completed, analyzed, reviewed, debated, polished, and finally presented to leadership, the world has often moved several steps ahead. The register becomes a historical document rather than a forward looking compass. It sits on a shelf for a year until the cycle begins again. Companies miss emerging risks not because they are invisible but because the organization is looking at old snapshots while new developments pass quietly in the background.

History is full of examples. Blockbuster believed that physical stores would remain the dominant model for entertainment. They saw Redbox as a novelty and Netflix as an odd startup. They did not recognize the shift toward convenience and digital access because their internal indicators were anchored in the past. More recently many creative industries underestimated how quickly AI tools would reshape their business models. Retailers who relied on traditional planning cycles have struggled to adapt to competitors that use real-time insights to optimize their offerings. Geopolitical tensions have intensified supply chain vulnerabilities for companies that believed their single region sourcing strategies were stable. Peloton continued to operate as if the demand of the pandemic era would persist, even as clear signals suggested saturation and consumer fatigue.

 

Executives feel blindsided when risks appear that were not on the register. It is the same helplessness as a captain who sails using an old maritime chart. The map says the waters ahead are calm but storms build quietly beyond the horizon. By the time the captain notices the shift it is too late to change direction without cost.

The solution is not to discard evaluation entirely. It is to replace static exercises with dynamic ones that actually create insight. Fresh insight appears when the conversation shifts from listing risks to exploring decisions. It appears when leaders discuss what must be decided, what uncertainties surround those decisions, which signals may indicate a shift, what drivers shape the environment, and what opportunities may accompany the threats. It appears when people stop staring at what might go wrong and imagine what might be possible.

 

I once facilitated a session with executives where I presented three plausible scenarios built from real signals and drivers. Each scenario held both risks and opportunities. Instead of rating likelihood and impact we talked about what actions would place the company in a strong position if the scenario unfolded. We explored what might hold the organization back, what pressures would shape the trajectory, and what early indicators would tell us that things were shifting. The conversation flowed naturally. People were animated and curious. They were speaking about downside risks without being trapped in them. They were discussing opportunities without labeling them as such. They were thinking in terms of decisions rather than surveys. By the end of the session, we had achieved more insight in a few hours than any survey could provide.

This approach is not theoretical. Foresight workshops, scenario discussions, dynamic decision portfolios, and real-time monitoring are practical and accessible. They allow leaders to keep a finger on the pulse of the organization and the external environment. They replace static pictures with a live feed that evolves as signals emerge.

 

For executives the question is not whether surveys have value. It is whether they genuinely believe their current risk registers are helping them make better decisions. If the answer is uncertain then the organization must explore alternatives. Leaders should ask themselves what results they hope to gain from surveys, whether they are gaining them today, and whether a more dynamic approach would offer more value. They should explore frameworks that prioritize decisions and uncertainties, incorporate multiple perspectives, and build in scans of internal and external forces that shape the future.

As we reach the end of this reflection the question becomes simple. When leaders look at their risk practices do they see something that brings insight or do they see something that repeats itself without meaningful change. Do they enjoy the process. Does it feel alive. If they could redesign it completely what would they create.

 

Risk work should feel like surfing. Surfers paddle toward the waves with anticipation. They study the water, the wind, the currents, and the subtle changes around them. They position themselves to catch the right moment. They adjust constantly as the wave forms beneath them. If all they focused on were the dangers they would never enter the water at all. They chase the potential for the ride.

Static surveys cannot offer that kind of awareness. They freeze a single moment and pretend it is enough. The future rewards those who move with the swell, who remain alert to shifts, and who welcome both risk and opportunity as part of the same living system.

This is how ERM breaks free from death by survey and becomes a source of true insight.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

The Talent Gap in ERM: Why Yesterday’s Skills Cannot Conduct Tomorrow’s Symphony

For years the world of enterprise risk has carried a quiet assumption that its talent pipeline would naturally follow the same path it always had. People who excelled in compliance, internal audit, or governance would eventually migrate into ERM. They would learn the frameworks, master the documentation, attend the meetings, update the heat maps, and keep the system moving. It was never questioned because for a long time ERM behaved like an extension of those disciplines. It looked backwards. It emphasized control. It focused on checking that the notes on the sheet music matched what had been played.

---

But at some point ERM began to drift away from what it was meant to become. It was never designed to be the final inspector of yesterday. It was supposed to sit closer to the front of the orchestra, listening to the changing tempo of the marketplace and guiding leaders before the next movement arrived. Instead, it stepped into a role that was safer and more familiar. Like a section supervisor counting beats after the performance, it became comfortable in documentation and slow to move into interpretation.

To understand why the talent imbalance exists, we have to rewind to the early and mid-2000s. COSO, Sarbanes Oxley, and a series of governance requirements reframed risk into something that lived next to compliance rather than strategy. It was not entirely intentional. Regulations were tightening and someone needed to manage the related oversight. ERM appeared to be the natural host, so it absorbed these responsibilities even though they gradually transformed its intent. Before long many ERM groups were reporting into internal audit. Once that happened the expectations, language, and background of the function changed. Governance, risk, and compliance became bundled together even though their purposes were not identical. It was a merger based on convenience rather than design, and the talent pipeline shifted accordingly.

Hiring followed comfort zones. Leaders brought in people who spoke the same vocabulary and operated from the same mental model. The assumption grew that ERM should attract auditors, compliance associates, or individuals trained to test whether something passed or failed. Entire career paths were built around this one idea. Internal audit would feed into risk and risk would eventually feed into the CRO role. In that process the original intent of ERM faded. It slowly traded its aspirational identity as a strategic partner for one that lived in documentation, controls, and assurance.

 

The consequence of this shift is visible today. Many ERM teams are staffed with people who know how to protect an organization yet are rarely asked to perceive what lies beyond the horizon. They can verify the notes that were played, but they are not trained to hear changes in tempo before the first violinist begins to move. The protective posture became so dominant that it began to suffocate the perceptive one. ERM turned into a form of helicopter parenting for corporate risk. It hovered, it demanded perfect mitigation plans, and it insisted on neat diagrams that made the world look more stable than it actually was. Like parents who clear every obstacle from their child’s path, ERM believed that tight supervision would create safety. In reality it prevented the organization from developing its own agility, curiosity, and readiness for failure.

There is nothing wrong with the classic audit or compliance mindset. These roles are vital and they serve a clear and important purpose. Someone must validate controls, test processes, and ensure that obligations are met and in compliance. The issue is that the same training and experience is often not enough to interpret weak signals, scan for drivers, or understand the larger forces shaping a company’s future. The gap is not about intelligence. It is about orientation. Audit excels at the linear path from A to B to C. ERM needs people who can walk off the trail entirely and understand the landscape that surrounds it.

---

Consider the difference between downhill ski patrol and backcountry search and rescue. Both are guardians of safety. Yet their work could not be more different. Traditional audit roles resemble the downhill environment. The boundaries are marked. The hazards are known. The job is to watch for deviations from expected patterns. Backcountry work requires something else entirely. It demands people who can navigate unfamiliar terrain, read subtle environmental changes, anticipate how snowpack will behave, and interpret what might be developing long before it becomes visible. Many ERM challenges look far more like the backcountry than the ski resort, yet our hiring tends to prioritize people trained for groomed slopes.

This talent gap is not simply a list of missing skills. It reflects a missing philosophy. Many ERM groups have the rigor. What they lack is imagination. The capacity to interpret uncertainty rather than fear it. The ability to build a scenario that reveals possibilities rather than simply measure exposures. The patience to look beyond the risk register and explore how geopolitical shifts, cultural changes, technological disruptions, or emerging behaviors might alter a decision before that decision is made.

---

Most ERM functions today still treat uncertainty as an afterthought. They focus on what they can test and record, not what they can sense or interpret. They gather data points like someone watching a control panel with only three or four indicators. When one of those lights flashes they respond. Yet the real story might be unfolding across hundreds of small signals that never fit into a control framework. The person who sees the whole board will always detect the problem much earlier than the person who waits for a specific light to blink.

The world has moved into ambiguity. ERM stayed rooted in documentation. Leaders face decisions shaped by nonlinear forces that shift without warning. Yet many ERM groups remain focused on evaluating what happened rather than understanding what could happen next. They became masters of Monday morning quarterbacking, describing yesterday in great detail, while failing to offer meaningful insight about tomorrow.

---

If ERM wants to remain relevant it must rethink the kind of talent it seeks. The future ERM leader looks more like a strategist, facilitator, technologist, linguist, and pattern reader rolled into one. They understand systems, not just spreadsheets. They can guide a conversation, not just produce a report. They can translate uncertainty into something leaders can act on. They can sense emerging conditions and shape how executives interpret them. They are the conductor who can hear when the tempo begins to change and alert the orchestra before the next movement begins.

These individuals come from a wide variety of backgrounds. They might be intelligence analysts, futurists, strategic planners, scenario designers, game theorists, behavioral scientists, or storytellers. They might be experts in digital ethics or competitive intelligence. They might come from places where interpretation mattered just as much as execution. Unlike the traditional ERM pipeline, they are not bound to one department or one style of thinking. They bring fresh language and a new posture that is curious, exploratory, and grounded in possibility.

But bringing this talent into ERM requires more than a job posting. It requires a shift in narrative. Talent follows narrative. When ERM signals caution, restraint, and defensiveness, it attracts people who identify with those traits. When ERM begins to speak in the language of exploration, scenarios, preparedness, and early signals, it opens itself to people who see uncertainty as an opportunity to generate insight. HR must stop assuming risk equals auditing. Leadership must stop thinking ERM is only a heat map and a meeting no one looks forward to. The vocabulary itself must change because words shape perception and perception shapes who enters or stays in the room.

---

There are barriers of course. Some executives question why they need someone who thinks like a futurist. Others wonder what the return will be when the work seems abstract. Yet the return is clear. Earlier signal capture. Faster adjustment to strategic shifts. Fewer unpleasant surprises. More moments where the company is positioned to seize advantage because someone noticed how the tempo was changing long before the rest of the orchestra realized it.

You cannot build an anticipatory organization with retrospective talent. If ERM continues to hire from the same narrow pool, it will continue to produce the same narrow outcomes. It will remain the function that documents risks instead of helping leaders navigate them. It will stay relevant only to the portion of the business that cares about regulatory compliance. Eventually it will fade, or has already faded, into a necessary utility rather than a strategic partner.

---

The future needs something different. ERM’s mandate is shifting from stewardship to sensemaking. The leaders of tomorrow will not be measured by how well they maintain heat maps or ensure control effectiveness. They will be measured by how well they help the organization interpret the forces shaping its future. They will act as translators who turn weak signals into meaningful conversations to address uncertainties. They will work with strategists, innovators, and technologists to explore how decisions might unfold. They will build scenarios, guide debates, and create clarity out of confusion. They will be conductors who help the entire organization hear what is forming long before the next movement begins and before the decisions are made, not after.

The future does not need ERM to prove what already happened. The future needs ERM to prepare leaders for what is coming.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

When ERM Becomes a Checkbox Exercise, the Business Loses the Point

Nearly every organization can produce a tidy risk register. They can show heat maps, control attestations, and mitigation plans. The problem is not simply that the documents provide little value. The deeper issue is the behavior they reinforce.

When enterprise risk management becomes a task of completion rather than a practice of decision support, it slides from influence to form filling. ERM should help executives make faster, clearer, and more flexible choices. When it becomes paperwork for auditors or compliance teams, it creates comfort, not resilience.

Below are the signs you have, or are slipping into, checkbox mode, why it matters, and how to change course before a quiet failure becomes a loud one.

---

A Check-the-Box Moment That Failed A Decision

An executive team rushed to approve a new supply chain contract. The deal promised faster delivery and a modest margin improvement this quarter. ERM was asked for a quick review. The team sent back a standardized heat map and a long list of controls. The heat map showed moderate supplier risk and the controls were checked green. The board signed off.

Six months later several key suppliers missed delivery windows. Inventory shortages forced production slowdowns and missed commitments. The controls existed on paper. They did nothing to catch the weak signals that mattered: early signs of cash stress among suppliers, shifts in routing times, and a regulatory change in one jurisdiction.

The artifacts were complete. The decision support was missing because it mattered more to complete the register, heat map, and control effectiveness document.

---

Diagnosis: What Checkbox Mentality Looks Like & Why It Emerges

Checkbox ERM has a familiar flavor.

Boilerplate risk registers that get copied from quarter to quarter. Heat maps that are colored more for shock and awe and to symbolize completeness than to guide action. Controls designed for auditors, not operators. Meetings whose agenda is depth of documentation rather than depth of judgment. Products that are static and dated the moment they are published.

Why does this happen? Four forces push ERM into checkbox mode.

First, as we spoke about previously, incentives. If the reward is to avoid audit findings, teams will optimize toward tidy documents that reduce scrutiny and create the perception that things are managed well.

Second, resource scarcity. When compliance tasks consume time, there is little left for horizon scanning and scenario planning. People have products to sell, deadlines to hit, training to complete, and teams to manage.

Third, leadership signals. When executives ask for documentation rather than counsel, ERM becomes a validation point. And if documentation is created after decisions rather than informing them, it becomes CYA paperwork, not risk work.

Fourth, measurement. If ERM is judged on volume, completeness, and annual attestations, it will deliver volume, completeness, and annual attestations.

When ERM is positioned as a proof point for regulators or auditors, leaders treat it as a cost center rather than a strategic capability. That narrows invitations to strategy conversations and locks ERM into reacting after decisions are made, if it is invited at all.

---

Why Checkbox Mentality Is Dangerous

Checkbox work creates three harms that often compound.

First, false confidence. Clean reports and dashboards give the illusion of control. Leaders read a green heat map and assume exposure is low. They do not see the missing signals that were never surfaced because surfacing them carried career risk. That also means decisions get made on incomplete signals and insights.

Second, opportunity cost. Time spent updating templates is time not spent testing scenarios, pressure-testing assumptions, or scanning weak signals. When teams are busy checking boxes, they miss emerging shifts that materially shape the business.

Third, cultural drift. If people are rewarded for avoiding scrutiny rather than raising uncertainty, they stop bringing bad news. A culture that punishes wobble produces a workforce that aims to be invincible or invisible. Both are dangerous.

Put simply, if an engineer realizes a simple design tweak may make a product 10x faster and more cost effective to manufacture, but has been taught that no one listens, innovation dies. Imagine if a nurse notices a medication dosage error but doesn’t question the doctor. The patient suffers an adverse reaction because the culture punishes those who speak up and a preventable outcome becomes a crisis.

If your ERM materials are busy but your surprises are increasing, you have evidence that the function is performing for auditors rather than for leaders.

---

Reframe: What ERM Must Be Instead

ERM is not a compliance machine. Its purpose is to help leaders make decisions under uncertainty with clarity and speed.

First, ERM must be a decision enablement function. Deliverables should map directly to decision points. Heat maps may be fine, but only if they link to the choices executives are being asked to make. And the question of whether a heat map adds value remains.

Do you create a heatmap when you are making a personal decision? When you are comparing refrigerators, do you create a likelihood and impact of failure for your new refrigerator and read each manual closely to develop what controls are in place for each of them that may mitigate the potential risk of failure? Do you then create plans to determine if you will accept the issues, avoid them by simply not having a refrigerator, confirm your transfer plan for the warranty purchase and period, and finally develop a detailed list of mitigation plans (with owners of course) on who will replace the filters, vacuum any dog hair from underneath it, put it on a separate, special circuit to avoid power surges?

Maybe you do, and if so, I cannot imagine what buying a house or making a major decision may look like in your household. But if you are like most people, you are not creating a heat map, you are making a decision based on as much of the meaningful input you have (i.e., the signals, drivers, and insights). Let’s assume you read that a $2,500 refrigerator has all the bells and whistles but is almost certain to have problems within a year or two. Alternatively, you read reviews on a $1,000 refrigerator which has over 15,000 5-star reviews. I am not sure you need a fully developed heat map to tell you that you are likely okay giving up a few of the functions (that will fail anyway) for a more dependable machine.

Second, ERM must be forward-looking. Replace static measurement with Signals, Drivers, and Insights.

• Signals show where reality is beginning to shift.
• Drivers explain why the shift is occurring.
• Insights translate that movement into implications for choice.

Third, ERM must be a strategy partner. The function should sit upstream in planning, not downstream in checkbox season. That way ERM helps shape commitments, not audit evidence.

When ERM functions this way, leaders move faster with greater confidence and fewer blind spots.

---

Practical Playbook: Five Immediate Steps to Move ERM From Compliance to Influence

These are small and reversible changes. They do require discipline, action, and likely a different mindset.

1. Reframe one deliverable. Replace a quarterly heat map with a two-page Signals, Drivers, and Insights brief tied to a current strategic decision. Track whether it changes the discussion.
2. Embed ERM into decision moments. Assign short ERM products to upcoming planning gates. ERM’s role is to clarify uncertainty instead of stamping documents.
3. Pilot rapid feedback loops. Run a one-month ERM pilot on a decision in motion. Show before and after.
4. Change incentives. Reward those who surface early signals. Recognition must be visible and linked to career benefit.
5. Clean house on documents. Audit your outputs. Keep only what changes behavior. Stop generating documents that serve CYA rather than leaders.

These actions are practical and simple. They reset what the organization rewards and what it pays attention to.

---

Closing Provocation & Call to Action

If ERM only produces tidy artifacts for auditors and compliance teams, it has created comfort, not resilience. The function becomes decorative, like books that look impressive but cannot be read or the hourglass on the desk that has not been turned in years.

Three questions to test whether ERM is performing or masquerading as an effective program:

• Is ERM invited into strategy conversations early, or only after the commitments are set
• Which ERM document has changed an executive’s decision in the last 12 months?
• What one decision this month could ERM sharpen, and how will you measure the difference?

Try this simple pilot. Replace one quarterly deliverable with a Signals, Drivers, and Insights brief tied to a high-stakes choice. Run it for one month. Share the results with leadership. If the briefing sharpened the decision, you have proof. If not, you have learning.

ERM’s job is not to eliminate risk. It is to strengthen the quality of decisions when uncertainty is present. When the function stops being a checklist and starts being a catalyst, the organization becomes faster, more resilient, and more capable of turning uncertainty into advantage.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

Research and Analysis: Making Decisions That Actually Matter

Imagine walking into a boardroom brimming with endless reports, polished slides, and real-time dashboards spread across tables and screens. Yet many leaders leave meetings wondering if they actually chose the right path or if they chose something just because action was expected. That confusion doesn’t stem from laziness or lack of smarts. It comes from having plenty of data but too little clarity. People rush toward action without pausing to ask which decision really matters now and which ones only feel urgent or look impressive.

Boards and executives juggle several decisions at once. Some relate to daily operations, others shape long-term strategy, and a few send symbolic messages. The choice that grabs the most attention often arrives fully packaged in neat slides, not the one that carries the greatest consequence. When time is tight, leaders gravitate toward what is easy to understand instead of wrestling with uncertainty. Yet the most important decisions carry the most unknowns. They demand judgment, interpretation, even discomfort. No slide can resolve them.

Without a disciplined way to sort priorities, organizations end up guessing. They accept the analysis on offer, even when it’s troubled by incentives, optimism, or a narrow frame. Decisions center on hope more than on understanding.

A simple personal example

A simple personal example shows how decision-making can work well. Deciding to propose to your partner is straightforward at its core. You ask or you don’t. Everything else swirls around that moment. There are uncertainties about whether they’ll say yes, whether families will approve, how to time it, what follows next: marriage, kids, career changes, possible pitfalls. Yet you also recognize solid signals. You’ve shared years of conversations about the future. You’ve navigated conflicts and repairs. You’ve built trust. Those observations aren’t guarantees, but they matter far more than a single argument on a bad day.

Beneath those signals lie drivers: shared values, compatible temperaments, mutual care when life gets hard. From there you interpret, weighing possibilities while accepting that uncertainty won’t vanish. You don’t give the same weight to every fight you ever had or every doubtful night. You focus on the indicators that truly shape your future together. In personal life we make meaningful choices by looking at what matters, sifting signal from noise, and exercising judgment. Somewhere along the way organizations forget how to do this.

When more information stops helping

All too often, executives are presented everything: more metrics, deeper context, longer histories. The aim feels right, yet the outcome is often the opposite. Once a conclusion starts to form, people pile on background details and extra appendices. Rarely does it change the decision. Instead, it creates a sense of completeness that dulls judgment.

Think of a red traffic light. In that moment you stop. You do not need a full briefing on traffic engineering, timing algorithms, or collision statistics. You know the light is red; that signal suffices. Presenting a board with a traffic manual when all they need to see is a red (or green) light turns information into noise.

The danger of confident stories

A second pitfall arises more subtly. Analysis is shaped by the people who produce it, and by their incentives. Sales teams pursue growth, marketing seeks visibility, finance champions numbers, executives look for momentum. Nobody sets out to mislead, yet assumptions get highlighted, issues get softened, scenarios get built around the outcomes people hope for. Uncertainty gets smoothed over, and hope replaces strategy. Overconfidence sets decisions too early.

A decision might succeed despite these flaws, but success doesn’t make it a sound decision. When it fails, the shock feels sudden even though the warning signs were there. The colleagues who point out those signs are often labeled troublemakers until an organization trains itself to listen to reassurance instead of reality.

Signals, drivers, and what actually influences decisions

Meaningful research begins with a simple question: what information would actually change this decision? A single angry customer feels urgent but is noise. A consistent drop in customer behavior across segments signals a real shift. A bad quarter turns to emotion unless it ties back to clear drivers.

Leaders need to decide what earns attention and what deserves to fade. Signals that affect key uncertainties should rise to the top. Data that only validates emotion or adds texture should fall away. By narrowing the focus, teams gain speed without becoming reckless. They can spot movement without pretending to predict the future. Their confidence stays grounded instead of inflated.

Foresight is not prediction

Executives aren’t fortune tellers. They are possibility analysts. The goal of research isn’t to achieve certainty but to sharpen judgment, frame options, and understand what might happen, why it might, and which outcomes really matter.

True foresight lives in interpretation, discussion, and independent thinking. It thrives when analysis is separated from advocacy and when teams ask which scenarios are plausible, which pose danger, and which distract from the core issue. Handled well, uncertainty becomes usable instead of paralyzing.

Building decisiveness under pressure

The payoff of this approach shows up when conditions shift rapidly and time runs short. Teams that have practiced selective analysis know which early warnings to watch and which drivers matter most. They interpret signals without overreacting. Their choices feel calm even under stress.

Teams that rely on volume of data struggle because they chase more numbers when they really need to make sense of what’s already in front of them. They debate texture while missing direction. Preparation looks quiet, and discipline seems unglamorous. The real reward arrives when it matters.

Closing reflection

Research and analysis exist to serve decisions rather than overwhelm them. The most valuable insight is rarely the most detailed. It’s the most relevant. Executives and boards don’t need to know everything. They need to know what matters most, why it matters, and how it shapes the choice before them.

Hope will always be present, as will incentives. The work lies in choosing which signals to trust, which uncertainties to face, and which information deserves a seat at the table. What information would actually change the decision you are about to make?

---

Let’s discuss how your research and analysis is providing you meaningful information to make the best decision. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

Preparing, Planning, & Practicing Your Response To A Crisis May Be The Difference Between Managed Success & Failure

There is a point in every crisis when seconds stretch and compress at once. The meeting room grows crowded, phones erupt with alerts, and fragments of data arrive faster than the mind can process them. In that moment, everyone searches for direction, sometimes clarity emerges, sometimes authority, and often merely the quiet hope that someone else will take the lead.

Uncertainty in a crisis is inevitable, yet many organizations assume they will navigate that instant skillfully despite never having rehearsed it. In virtually every other field, this would seem unthinkable. No professional football team would forgo its offseason training, neglect to develop a playbook, and step onto the field believing raw talent alone will secure victory. No concert pianist would approach a grand piano before thousands without dedicating hours to rehearsal, trusting that instinct will fill every gap. We understand, almost instinctively, that excellence under pressure hinges on repetition, coordination and mutual trust built long before performance begins.

Yet in crisis management it is common to draft procedures, file them away, and reassure oneself that a binder exists somewhere. Organizations comfort themselves with the notion that when the crisis hits people will simply “figure it out.” A crisis quickly exposes the fragility of that assumption. As soon as something goes wrong, a cascade of practical questions floods in: who holds authority, which decisions take priority, which facts matter, how rumors must be distinguished from reality, who requires notification, what messages must be sent immediately and what can wait. These are operational demands that require rapid answers and punish any hesitation.

A crisis playbook provides structure, defining roles, responsibilities, escalation paths and communication protocols. It creates a shared vocabulary, reduces friction and offers a starting point. But no document can predict how individuals will respond when stakes are high. People who remain composed in board meetings may freeze under stress. Those who seldom speak may suddenly dominate every conversation. Tensions buried during normal operations can erupt once uncertainty enters the room. Lines of authority that appear clear on paper blur in practice.

These dynamics become visible only through practice, by sitting together, working through realistic scenarios and learning to navigate the discomfort of disagreement before it matters. Tabletop exercises, simulations and crisis panels are not designed to produce perfect answers. They reveal how decisions will actually be made when time is short and information remains incomplete. These sessions show where assumptions collide, who leans toward immediate action and who exercises caution, and which conflicts might emerge at the worst possible moment.

With no practice, organizations discover their true character mid‐crisis. With practice, they learn quietly in advance, when mistakes remain safe and corrections remain possible. Early decisions often shape everything that follows. Choices about life safety, operations, public messaging, regulatory engagement and overall strategy can become impossible to reverse. Even seemingly minor decisions constrain future options in ways that only become clear later.

When preparation is absent, uncertainty multiplies and improvisation sets in. Different functions interpret information through their own lenses, legal teams worry about exposure, communications teams worry about perception, operations teams worry about continuity, risk teams worry about escalation. Each believes it is supporting the response, but without alignment, support fractures into confusion. Manageable incidents spiral downward not because the initial problem was catastrophic, but because coordination fails under pressure.

I have witnessed crises in which the original issue was limited, yet a disjointed response magnified its impact. Conflicting messages spread to stakeholders. Decisions were delayed while teams argued over wording. Authority was unclear and initiative stalled. The organization lost control of the narrative not for lack of expertise, but for lack of cohesion.

Cohesion does not emerge spontaneously; it must be built. A crisis panel convened before a crisis changes everything. Bringing together leadership, legal, communications, operations, risk specialists and external advisors allows each participant to understand not only individual responsibilities, but also how others will view the same situation. That familiarity fosters trust, clarifies who leads and who advises, and defines how discussions turn into actions.

Such exercises also reveal the most important variable of all: human response to stress. Under pressure, people take mental shortcuts, fill informational gaps prematurely, react emotionally and guard themselves against blame. Self‐preservation can compete with the organization’s best interests, and transparency erodes when mistakes feel punishable instead of instructive. These reactions are not moral failings, but natural impulses. The only way to surface them safely is through realistic drills.

Emergency drills feel different from actual events precisely because participants know they are practicing. In a real crisis, true behavior emerges. Leaders who believe they will remain composed sometimes discover otherwise. Others learn they can steady an anxious team simply by slowing the pace and asking focused questions. Such insights cannot be gained from slides alone.

Preparation also transforms the role of external experts, law firms, communications agencies, forensic specialists and insurers. These advisors bring deep experience across industries, but they lack the living context of your organization’s culture, priorities and nuances. When internal teams are unprepared, external advisors fall into a reactive mode, scrambling to impose structure while simultaneously learning context. When teams have practiced thoroughly, advisors become force multipliers, moving swiftly, recommending precisely and shaping outcomes instead of merely containing damage.

Credibility in a crisis depends on alignment. Once messages diverge, trust erodes quickly. In a world where information circulates instantly and indefinitely, inconsistencies are recorded, shared and remembered. Stakeholders do not demand perfection; they demand coherence. They expect clear leadership, a genuine understanding of events and actions that match spoken commitments. Achieving all this demands far more work before a crisis than during it.

Organizations that manage crises effectively often leave little trace behind. Their issues do not dominate headlines. Their responses feel calm, deliberate and proportionate. Observers may chalk their success up to luck, but more often it is the result of rigorous preparation. That preparation is quiet, provides no immediate returns and competes against growth‐oriented initiatives. It requires time, attention and a willingness to imagine failure before success, discomfort before reassurance.

Yet it is this very work that enables an organization to act with confidence when it counts, confidence grounded in familiarity, built on shared experience and earned through practice. A crisis will always test an organization. The difference lies in whether that test becomes a moment of discovery or a painful confirmation. Whether leaders learn who they are under pressure or are exposed for who they hoped not to be. Planning matters, practicing matters more. The divide between reacting and responding is not instinct but preparation remembered under stress. And that preparation must begin long before anyone realizes it is needed.

Stay tuned for additional posts on Crisis Management – Who Has Gotten It Right…Or Wrong as well as What Is A Crisis Management Panel (And Do We Really Need It).

---

Let’s discuss how to ensure your crisis response may be improved to ensure you are ready. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

#8 Misaligned Incentives – When Incentives Pull Against Sound Decisions

Most organizations do not fail because no one saw the risks. They fail because the incentives that guide everyday decisions point in a direction that makes it hard to see the signals clearly. Incentives shape pressure, pressure shapes behavior, and behavior shapes the information leaders receive. When that chain bends, even the smartest teams drift toward blind spots they never intended to create.

ERM usually enters the conversation too late. Not because the function lacks insight, but because the system it operates within rewards speed, optimism, and clean reporting far more than it rewards thoughtful interpretation of signals. When incentives are set up this way, ERM cannot help the organization move faster or make better choices. It becomes a passenger to forces that were already steering the ship.

Misalignment of incentives is one of the least discussed reasons ERM loses influence. Yet it is also one of the most fixable. The challenge is recognizing how deeply incentives affect the decisions people make long before risks surface on a slide deck.

Below we explore this problem, how it forms, and how leadership can correct it before it becomes a threat to strategy and resilience.

---

The Quiet Power of Incentives

Incentives are a compass that people follow even when they are not aware of it. They tell employees which outcomes matter, what behavior is rewarded, and where leaders should place their attention. When those incentives favor hitting targets without regard for how those targets are reached, uncertainty becomes something to work around rather than understand.

Think of two different kids growing up. One is rewarded for curiosity, problem-solving, and solid judgment. When they make sound decisions, they are praised for the thinking behind it. They try new things because the incentive is growth. They take risks where appropriate because learning is encouraged.

The other child grows up in the shadow of punishment. Their goal is not to understand but to avoid getting in trouble. They do just enough to stay out of harm’s way. Their world shrinks to minimum acceptable behavior, and they learn to hide mistakes rather than surface them.

Both children grow up. Both enter the workforce. One naturally seeks better options. The other seeks safer optics. Incentives write habits long before performance reviews do.

You can see the effect in many well-known failures. At Wells Fargo, unrealistic sales goals made it rational for employees to open unauthorized accounts. At Boeing, schedule pressure and cost goals shaped decisions that compromised engineering judgment. In both cases, the risk was not invisible. The incentives simply made it harder to acknowledge and decisions suffered as a result.

Organizations often reward the results of risk taking without asking whether the decisions that produced those results were sound. A lucky quarter looks the same as one managed well. A risky move that did not break anything appears bold instead of reckless. This creates a culture where the quality of decisions matters less than the appearance of performance.

ERM becomes an afterthought in this environment. It may be respected, but it is not needed until there is a problem. By then the incentive structure has already done the damage.

The real question is simple. If incentives silently steer the business toward speed, avoidance, or narrow metrics, how can any risk function hope to provide clarity?

---

How Incentives Distort Signals Before They Reach Leadership

Most executives do not receive bad information, although a number certainly do. They receive filtered information. The filtering happens long before a risk reaches a report or meeting. It happens because people interpret signals through the lens of what benefits or harms them.

When compensation, evaluations, or political capital depend on maintaining a clean narrative, uncertainty becomes something to manage quietly. Leaders are not trying to deceive anyone, though we can argue some are intentionally attempting to do so. More often, they are responding to the pressures placed on them. If calling attention to something slows a project or invites scrutiny, withholding the signal becomes the safer path.

You can see this pattern in how weak signals surface inside companies. Early warning signs often appear, but they arrive late or softened. Teams explain away issues as temporary. Small incidents get categorized as noise. Everyone assumes someone else will say something if the concern is real.

When you learned to ride a bike, falling wasn’t failure. It was how you learned balance. No one scolded you for wobbling or losing control. The environment encouraged the struggle because the struggle was the path to competence. In many organizations the opposite happens. Teams are punished for early signs of instability, so they hide the wobble. They wait until the fall becomes public. The learning arrives late, and the cost arrives early.

ERM often becomes the one function that tries to call attention to what others are incentivized to downplay. It is not that ERM is too slow or too cautious. It is that the organization has been trained to prefer optimistic interpretations, even if rooted in delusion. That optimism is rewarded. Transparency is not.

The danger is not that incentives distort information. The danger is that they distort it quietly.

---

When Good Outcomes Hide Bad Decisions

One of the most important questions a leader can ask is whether their organization knows the difference between a positive outcome and a sound decision. Many do not.

Imagine two investment decisions. The first is based on careful analysis, strong signals, and a clear understanding of uncertainty. The second ignores early warnings but works out anyway because the market stays favorable. Both may succeed, but only one builds resilience.

If the organization rewards both equally, employees quickly learn that luck is just as valuable as judgment. They will naturally pursue whatever option delivers the fastest win. The long-term cost becomes invisible. That’s a problem for another day.

The same problem shows up in performance reviews. When leaders are measured on growth alone, they optimize for growth alone. When they are rewarded for speed, they prioritize speed. When they are evaluated based on project delivery, they deliver the project even if it means cutting corners that create problems later.

Most of the time, none of this is malicious. It is human nature responding to visible incentives.

This raises a difficult question. If someone achieves their metrics while creating vulnerabilities that emerge months later, should that be considered success?

The issue is not that teams lack discipline. The issue is that they are responding logically to what the company implicitly rewards. Incentives do not only influence behavior. They shape the information that is surfaced, the risks that are ignored, and the opportunities that are never explored.

This becomes dangerous when performance metrics focus on the past instead of what is emerging. Metrics rooted in historical patterns distort what leaders believe they are seeing.

---

What Happens When Incentives and Decisions Finally Align

To see the danger clearly, look at Abraham Wald’s work in World War II. The planes returning from missions had bullet holes in certain places. The initial conclusion was to reinforce the areas with the most visible damage. Wald realized this logic was backward. The damage on the returning planes showed where a plane could survive a hit. The missing planes, the ones that never came back, likely were hit in the areas without bullet holes. Those were the areas that needed reinforcement.

This is a picture of what happens inside companies every day. Leaders reinforce what is most visible even if it is not what needs attention. Teams report what flows toward incentives and not towards what needs to be said. Important issues stay invisible because the reporting system has been shaped by incentives rather than by truth.

To correct this, companies need forward-looking indicators that show where reality is shifting instead of only where it has been. That is where signals, drivers, and insights replace the narrow view of KPIs and KRIs.

Instead of relying on KPIs and KRIs that often reflect what has already happened, organizations should anchor decisions (including risks and opportunities) in three categories. Signals show where reality is starting to shift. Drivers explain what is influencing those shifts. Insights interpret what the shift means for the decisions at hand.

This structure encourages people to surface what is emerging, not just what is measurable.

---

How to Realign Incentives Without Slowing the Business

Fixing this problem does not require more oversight, heavier processes, or new layers of review. In fact, those usually make the issue worse. Incentive alignment works best when it is simple and deeply practical.

There are several ways to support that change.

First, reward the attempt, not only the outcome.
Celebrate when someone makes a thoughtful decision even if the result is imperfect. This mirrors how you learned to ride a bike. Progress requires a tolerance for wobbling.

Second, bring emerging information into the conversation.
Use signals, drivers, and insights to help people understand shifting realities before they become problems. This reduces surprises and encourages teams to engage with change earlier.

Third, ensure there is safety around judgment.
People think more clearly and creatively when they do not fear punishment for honest mistakes. They also surface risks earlier and more accurately.

Fourth, reinforce long-term thinking.
Reward teams for actions that position the organization well beyond the current quarter. Good decisions often mature over time, unlike fast money, which trades speed for stability and usually carries a cost too high for most to handle.

Finally, close the loop.
Show people when a thoughtful decision created a benefit. Show them when quick action avoided a problem. When teams see a connection between judgment and impact, incentives realign themselves.

When companies shift from a culture of misaligned incentives (including avoidance) to a culture of thoughtful action, they do more than reduce risk. They unlock a higher level of performance. Decisions become clearer. Opportunities become more visible. Teams begin to act with a sense of confidence.

Good decision making is not a talent. It is a product of the environment. When incentives encourage people to think, learn, try, and adjust, the organization becomes stronger than any dashboard or framework. That environment is what allows risk management to stop being a defensive function and become a strategic advantage.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

When the Forecast Expires (Part 2): When Background Noise Becomes the Environment

Inside portfolio companies, urgency is not abstract. It lives in hiring gaps, customer expectations, stalled integrations, supply strain, and product delivery. When the present is loud, the future becomes quiet. Signals about technology shifts, buyer behavior, regulatory drift, or cost of capital get pushed aside as background noise.

The trouble is not that leaders ignore signals. It is that they prioritize what is right in front of them because it is measurable and immediate.

But signals do not stay quiet forever. They mature, and once they do, they are no longer signals, but become conditions. By the time a shift becomes obvious, options have narrowed, pricing leverage has changed, talent has moved, and competitors have adapted.

Executives Experience This Differently Than Operating Partners

While a PE operating partner sees patterns across a portfolio, a CEO, CFO, or COO inside a portfolio company lives inside the constraints of that one system. Their forecast is not conceptual, it funds hiring, expansion, procurement, debt service, and market moves.

This is why the executive view may turn defensive. Not out of denial that things are shifting, but because forecasts hold the operational world together. However, forecasts are not declarations. They are temporary lenses that require updating, not defending.

The Questions Executives Should Ask

• What would we change if one driver accelerated faster than planned?
• Which signals have quietly turned to a new state without our acknowledgment?
• What once gave us advantage that is now becoming standard?
• How do we stay ahead of new standards to create a competitive advantage?

Embedding Uncertainty Where It Belongs

This is not a call for more dashboards, more meetings, or heavier reporting. It is an invitation to integrate early interpretation into:

• Weekly commercial reviews
• Pricing and margin decisions
• Technology investments
• Product roadmaps
• Exit readiness modeling

Not to add noise or create unnecessary theatrics, but as part of performance itself. Most strategic misses do not come from lack of effort. Instead, they come from the time gap between “we sensed this coming” and “now we have to respond.” Or more pointedly, “we have to do something right now” and “how did we miss this?” As we have seen, it is rarely something was missed, as much as it was ignored because more pressing “today” issues were present.

When interpretation becomes as consistent as execution, leaders stop bracing for impact and begin shaping the environment they operate in.

---

Let’s discuss how to keep your strategy moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

#7 Using AI in ERM

AI was meant to enhance judgment, not replace it. Yet we now face an uncomfortable question: what happens when the tool designed to strengthen human reasoning begins to erode it?

Enterprise Risk Management, like most disciplines, is not immune to the allure of automation. Many programs already operate with precision yet produce little value. In such cases, AI risks amplifying what is already hollow. In the wrong hands, it becomes another layer of efficiency without insight, another polished system with little substance behind it. It is like buying a powerful drill and choosing to turn the screw by hand. The tool has power, but it is the user who decides whether to use it.

But in capable hands, AI may transform the way ERM operates. It can accelerate analysis, identify patterns that humans might overlook, and place validated information in front of executives while it still matters. The issue is not the technology itself but how we use it. If AI becomes a replacement for thinking, it will only make ERM faster at being irrelevant.

The danger lies in mistaking data-driven speed for understanding. The risk grows when the data that drives that speed is biased, manipulated, or selectively presented to reinforce a preferred narrative. In those cases, AI does not enlighten decision-making; it amplifies what was already wrong. The paradox is clear. AI can elevate ERM’s capabilities, yet quietly erode its essence if left unchecked.

---

What AI Strengthens

AI’s greatest strength lies in its scale. It can absorb more data, more reports, and more variables than any human or team could ever hope to review. Used thoughtfully, it can supercharge scenario planning, horizon scanning, and the detection of early signals that might otherwise go unnoticed.

It can also help surface what is often missed in traditional ERM cycles: the indirect risks, the faint correlations, and the weak signals that rarely appear in management reports until it is too late. The question is not whether AI can find them but whether we know how to interpret what it finds.

The way AI is used matters far more than its inherent capability. Asking AI for evidence-based information, diverse perspectives, and verifiable sources can sharpen foresight rather than distort it. Prompting it to explore arguments and counterarguments helps expose bias rather than embed it. If prompted poorly, it will simply confirm what we already believe.

When managed well, AI can make ERM faster and more relevant. Real-time monitoring that once took quarters can now be achieved in days. Data validation, once an exhaustive process, can now be automated. Executives can have access to risk insights while decisions are still being made, not after the fact.

Yet this progress should not redefine ERM’s purpose. The role of risk management has never been to gather information but to interpret it. AI can expand the field of vision and improve the pace of analysis, but the meaning of what it sees still depends on human judgment.

---

What AI Impairs

The benefits of AI come with a shadow. As organizations adopt more machine-led analysis, they risk dulling the very skill ERM depends on: discernment.

When risk professionals defer judgment to algorithms, accountability begins to fade. If the model fails, the blame shifts to the machine. Consistency replaces curiosity, and standardization replaces interpretation. AI might suppress human bias, but it can also hard-code systemic bias. It can streamline process but erode creativity.

The greatest risks AI fails to see are those rooted in human nature. It does not understand ambition, pride, or fear. It cannot sense when personal interest overtakes collective good, or when reputation quietly starts to unravel. It cannot interpret ethical or emotional context. It can calculate the probability of fraud but not the temptation that causes it.

These are not secondary details; they are the essence of why ERM exists. Every major failure in business history has included human elements such as ego, greed, pressure, or moral compromise. AI may recognize the pattern but not the motive. It cannot perceive intent or nuance. It is a little like a zombie film. We create the threat, and yet we are the only ones who can stop it. Risk is rarely born without us.

And then there is the issue of transparency. AI systems often operate as “black boxes.” They provide an answer, sometimes a compelling one, but cannot always explain how it was reached. When this occurs, the appearance of intelligence masks the absence of understanding.

ERM depends on trust. It depends on the ability to trace logic, understand assumptions, and test conclusions. If the reasoning behind an AI output cannot be explained, the insight cannot be trusted. The danger is not that AI lies, but that it can sound completely truthful even when it is wrong.

Risk management’s strength lies not in calculation but in interpretation. Without that human layer, ERM becomes just another algorithm, efficient and empty.

---

The Board’s Dilemma

Sooner or later, boards will ask a question that will make many risk leaders uneasy: if AI can do this faster, why fund ERM to the level we are, or at all?

Maybe it is a fair question, but maybe not. Either way, it confuses speed with substance. Faster does not always mean better, and data without discernment is not assurance.

AI can produce elegant dashboards filled with predictive curves and probability metrics. It can automate the monitoring of financial trends, supplier risks, and macro signals. It can even summarize exposure maps that once took months to compile. But none of this guarantees understanding…or accuracy.

The ERM leader must remind decision-makers that a dashboard, however sophisticated, is not a decision. It is a signpost. Progressing along the path to the next signpost still needs to be taken, in a measured way.

The value of ERM lies in its ability to interpret what the data implies, not just what it says. It lies in discernment. The capacity to put data into context, understand what motivates people (even if illogical), and communicate the implications in ways that drive action.

ERM, at its best, functions as a translator between risk information and human behavior. It listens, probes, and connects dots. In that sense, it is less about control and more about understanding. AI can support that process, but it cannot replicate it.

Like a skilled interpreter between two languages, ERM ensures that nothing meaningful is lost in translation. If we let AI speak alone, we risk hearing everything and understanding nothing.

---

Redefining ERM in the Age of AI

AI does not diminish ERM. It redefines what ERM must become.

The next generation of risk professionals will need to master data literacy, algorithmic ethics, and the ability to question how AI reaches its conclusions. They will need to know when to trust the data and when to dive deeper into it, which is likely frequently. They will need to see AI as a partner in analysis, not as the analyst itself.

Used properly, AI should free human capacity. It can reduce manual tasks and data wrangling so that professionals can focus on sensemaking, synthesis, and decision quality. But it will also demand a new discipline: validating what is generated, testing for bias, and applying ethical filters to ensure what is efficient is also right.

The organizations that thrive will not be those that replace humans with machines, but those that combine their strengths. AI will be the engine of speed and scale. Humans will remain the source of conscience and context. Together, they can produce insight that is both fast and thoughtful, both scalable and ethical.

ERM should also take a leadership role in governing how AI is used across the enterprise. The same principles that underpin good risk management such as transparency, accountability, and fairness, should guide how AI is designed and applied. ERM is uniquely positioned to ensure that efficiency never comes at the expense of integrity.

---

The Irreplaceable Human

In the end, AI can simulate thinking but not caring.

Judgment is not only a cognitive act. It is emotional, ethical, and experiential. It is shaped by learning, by empathy, and by the lived experience of being wrong and trying again.

AI might one day recognize the patterns that precede a failure, but it will never feel what it means to fail. It will not understand the weight of a decision or the cost of a mistake. It cannot distinguish between positive stress that builds resilience and negative stress that breaks it. AI doesn’t know what a long run feels like, it cannot comprehend taking a cold plunge. It has never been awestruck looking at the night sky or a sunrise. It can only reference what others have written about those experiences.

ERM must remain the conscience that interprets what AI cannot. It must question not only what the data shows but what it omits. It must ensure that decisions are not only informed but also humane.

The future of ERM will not be defined by whether it uses AI, but by how it uses it. If AI is the accelerator, humans must remain the steering wheel.

AI may strengthen the system, but only humans define its meaning.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.

 

---

The Future of ERM: 12 Hidden, or Not So Hidden, Threats

#6 Language Barrier

Enterprise Risk Management is like many areas, which uses a seemingly different language. The words that make perfect sense to risk professionals can sound foreign to executives, boards, and business leaders.

ERM is filled with well-intentioned terms like likelihood, impact, inherent, residual, controls, and heatmaps, but to many outside the field, it sounds like code. When people stop listening because they do not understand, ERM loses its ability to influence.

---

The Problem: Jargon That Divides

Risk discussions often get lost in technical language. Whether it is “ERM speak” or risk owners using unfamiliar acronyms, the result is the same: confusion. A good leader once told me, “Know your audience.” Executives, Audit Committees, and Boards do not care about complicated terminology or detailed frameworks. They want to know that you are capable, reliable, and that the risk or opportunity is in the right hands.

If they do not understand what you are saying, you have likely wasted their time. Speak clearly. Explain what matters. Build confidence through clarity.

So why do risk professionals still rely on words like “inherent” or “residual risk” when they do not connect with executives? Answer: Many come from audit backgrounds where structure is everything. The challenge is that ERM is not just structure; it is also interpretation. A solid ERM professional has to be comfortable with uncertainty and able to explain it in simple, direct language.

When ERM reports sound like they were written for auditors instead of decision-makers, they get ignored or dismissed. They become conformity paperwork, not strategic input. Let auditors be auditors. ERM should be something else entirely.

Think of football. The quarterback and linebacker both play critical roles, but you would never ask one to do the other’s job. The same applies here. Audit confirms that controls work. ERM ensures leaders make better decisions. When ERM starts talking like Audit, it loses its voice on the field.

Too often, risk reports are built to validate expertise rather than enable understanding. The charts, heatmaps, and dashboards look impressive, but they rarely change behavior. If executives do not use the information, it has little to no value.

Reflection for readers:
When was the last time an executive quoted your ERM report in a meeting because they found it useful, not because they had to?

---

Why It Happens: The Comfort of Technical Speak

Jargon is comfortable. It signals knowledge and ties to frameworks like COSO and ISO. It also creates distance. Many risk professionals use technical terms not to simplify complexity, but to mask uncertainty.

These words sound precise but rarely make the issue clearer. They give a false sense of control.

In reality, business and life are rarely that neat. When I go mountain biking, I do not think about “inherent risk.” I check my equipment, make sure my tires are good, and wear my helmet. I understand that I may fall, but I manage what I can. I do not need a heatmap to tell me that a crash is bad.

We complicate what should be simple.

Risk professionals also tend to be more comfortable talking to one another than to business leaders. They want to be seen as experts, when their real strength should be facilitation. ERM is not the expert in operations or finance (or any other department); it is the connector.

If I were speaking with Alex Honnold about free climbing, I would not interrupt to show what I know about ropes. I would listen. I would ask questions to understand. That is how ERM should approach conversations with business leaders and executives.

If you want to explain a risk clearly, imagine you are explaining it to a student. Avoid acronyms, skip the jargon, and focus on what matters. If I am describing supply chain risk, I do not need to say, “It is a high likelihood, catastrophic impact, severity score of 20.” It is far more effective to say, “We are concerned about getting materials on time. We have reduced delays, but it remains something to watch to see if we should make alternative decisions.”

Clear language builds trust. Complex language creates distance.

Reflection for readers:
Is your ERM function speaking a language the business can actually act on?

---

The Cost: Losing Influence

When communication fails, influence fades. Leaders stop reading what they cannot quickly and easily understand. They stop asking questions. The ERM function becomes a box to check instead of a partner to trust.

Imagine preparing to dive with sharks. You do not want a technical briefing filled with equipment terminology and probability charts. You want someone you trust to tell you exactly what to do if something goes wrong. That is what executives expect from ERM: clear direction and confidence.

If the audience is intelligent and still confused, the message has failed. If they ask questions, consider that a gift. Most will not ask; they will simply stop listening.

ERM often does not realize how much credibility it loses when the message feels disconnected from the real world. The insight may be there, but it is buried under layers of technical language that prevent understanding.

Reflection for readers:
If ERM disappeared tomorrow, would executives miss the insight or just the reports, or neither?

---

The Fix: Translating Risk into Business and Storytelling

Risk communication should be plain, visual, and memorable. ERM’s purpose is to translate technical analysis into business terms that drive understanding and action.

Most ERM professionals were not trained as storytellers. The field grew out of compliance and control, not communication. But as ERM has matured, so has the need for clear and compelling storytelling. A good ERM story helps leaders see both the risk and the opportunity.

A memorable report is one that is used. If an executive refers to it weeks later because it shaped a decision, that is success. If they only remember the colors of the heatmap, that is noise.

Accuracy and simplicity can coexist. Each organization has its own tone and culture. Learn that tone, adapt to it, and use clear language that fits. You do not have to simplify meaning; you have to simplify communication.

Think of cooking. No one needs to know the chemical composition of salt to understand flavor. The same applies to risk. The language should help understanding, not make it harder.

Reflection for readers:
When was the last time someone told you they enjoyed reading an ERM report because it helped them see something clearly for the first time?

---

Bringing It Together

ERM’s biggest challenge is not just data, frameworks, or structure. It is being understood. The words we use determine whether people listen or tune out.

Speak clearly. Listen closely. Be the translator that helps leaders make sense of complexity. When that happens, ERM stops being a mandatory exercise and becomes a true driver of decision-making.

---

Let’s discuss how to keep your risk program moving forward without missing a beat. Click here to schedule a Discovery Session or use the Discovery Session button on my website.