The 5 Questions Every Board Should Be Asking About Risk

Risk has become significantly more complex over the last decade. Geopolitical instability, cyber threats, reputational exposure, supply chain disruption, and rapidly evolving technology have increased both the pace and complexity of decision-making for organisations of all sizes. Most boards recognise this.

The challenge is that many conversations around risk remain too high-level, too operationally disconnected, or too focused on compliance rather than preparedness. Effective risk management is not simply about identifying threats. It is about understanding how an organisation would function under pressure and whether leadership is genuinely prepared to respond.

These are five questions every board should be asking.

1. What are we most exposed to?

Many organisations maintain extensive risk registers, but not all risks carry the same operational or strategic impact. Boards should have a clear understanding of the incidents most likely to cause serious disruption, reputational damage, financial loss, or leadership pressure. That exposure may differ significantly depending on the organisation. For some, it may be cyber-related. For others, it may involve supply chain vulnerabilities, insider threats, regulatory scrutiny, activism, product contamination, or geopolitical instability. The important point is clarity. If leadership teams cannot clearly articulate their most significant risks, it becomes far more difficult to prepare effectively.

2. How would we actually respond?

A documented plan is not the same as operational readiness. Boards should ask whether the organisation has genuinely tested how it would respond during a fast-moving incident.

• Who would lead the response?

• How would decisions be made?

• How would information be managed?

• What external support would be required?

• How would stakeholders be communicated with?

  
  

These questions often expose gaps between policy and reality. In many cases, organisations only discover weaknesses in structure, communication, or decision-making once they are under pressure.

3. Have we tested leadership under pressure?

One of the most overlooked areas of preparedness is leadership performance during a crisis. Senior individuals may be highly experienced in their professional roles, but crisis environments introduce different pressures entirely. Time compression, uncertainty, incomplete information, and reputational risk can significantly affect decision-making dynamics.

This is where exercising and scenario-based training become valuable. The purpose is not to create unrealistic fear. It is to build familiarity, confidence, and alignment before a real incident occurs. Boards should be asking not only whether plans exist, but whether leadership teams have practised operating under realistic conditions.

4. Are we relying too heavily on assumptions?

Many organisations unintentionally build their preparedness around assumptions. They assume that:

• Systems will remain available.

• Key individuals will always be reachable.

• External partners will respond immediately.

• Information will be accurate early on.

  
  

Crises rarely unfold as expected. Preparedness requires organisations to challenge assumptions and consider how they would operate if conditions deteriorate or information is incomplete. Boards should encourage constructive challenges around resilience, dependencies, and operational blind spots.

5. Are we prepared for the reputational impact?

In many incidents, the operational issue becomes only one part of the challenge. Stakeholder confidence, public scrutiny, media attention, and reputational perception can escalate quickly, particularly in an environment where information moves rapidly and narratives develop in real time. Boards should consider whether communication strategies are aligned with operational response plans and whether leadership understands the wider reputational implications of decision-making during an incident. The organisations that navigate crises most effectively are often those that maintain clarity, consistency, and credibility throughout the response.

The Importance of Continuous Preparedness

Preparedness is an ongoing process. Risk cannot be removed entirely. However, organisations can significantly improve their resilience through preparation, exercising, and clear leadership structures. The most effective boards are not those attempting to predict every possible scenario. They are the ones asking better questions, challenging assumptions, and ensuring preparedness is treated as an ongoing process rather than a one-off exercise.

In complex environments, preparation is not simply operational good practice. It is a leadership responsibility.

As we navigate these complexities, I recognise the value of being proactive. By understanding our vulnerabilities and preparing for various scenarios, we can better protect our organisations and stakeholders.