Risk management

Challenging stuff

A recent article in the Wall Street Journal entitled “What Makes a Great Board Director?” included this observation about risk and the challenges it creates for Boards: “Risk never sleeps and it constantly mutates.”¹

As leaders (whether on the Board or not) we see it everywhere: economic uncertainty, shifting regulatory requirements, the growing menace of cyberattacks, competitive threats, the potential for internal control lapses, etc. And it absolutely does make our leadership challenging.

Managing risk

So how do we deal with the reality that the future is filled with uncertainty? What do we do about risk?

We manage it.

We can’t pretend that risk isn’t a prominent aspect of our reality. So we either deal with it as responsible steward leaders or we ignore it and, along with our company, suffer the consequences.

At minimum, risk management involves these three disciplines.

Monitoring

Two risk categories help us think through what and how we monitor:

1. Known unknowns: These are things that we already know are uncertain in the future.

In banking, we know that we do not know what next year’s interest rate environment will be. In business in general, we know that we don’t know what the macro and microeconomic situations will be in the coming years. Nor do we know what competitors and customers will do, whether fallible humans will be 100% reliable in their internal control responsibilities, what the outcomes might be of tumultuous public policy debates. And on and on. These are unknowns that we know now are unknown.

2. Unknown unknowns: These are the things we don’t know to anticipate, the so-called black swans in our future: things like COVID, the terrorist attacks on 9/11, the development of new technology (especially when it threatens our business model), or the early demise of a key executive.

Notice that the boundary between the two categories isn’t a bright line. Many of the examples of unknown unknowns above could have been (and possibly were) anticipated. But what’s important related to risk management is understanding that we face familiar uncertainty and also surprising, unexpected uncertainties.

So effective risk monitoring involves watching for both.

One of the most effective practices for identifying and monitoring risks in both categories is actively maintaining a 360° awareness of all strategic matters within the company, and simultaneously a 360° awareness of all external strategic matters. This 720° scanning of all the relevant horizons helps you spot squalls developing before they become crises.

Measuring

Of course, not all of the risks out there lend themselves to quantification. But even when we can’t measure effects with high precision, we can still benefit from an understanding or even an informed estimate about direction, degree, and intensity of the possible or developing situations.

In other instances, the effects are quantifiable:

• How much the value of a bank’s loan portfolio changes when interest rates change.
• How customer behaviors change when economic conditions shift. For instance, we all know that homeowners are less likely to refinance mortgages when interest rates rise.
• What inflation or tariffs could do to costs in supply chains.
• How a change in tax policy affects profits.

In these instances, and especially if the exposure is significant or the expectation of a change is high, we are imprudent not to estimate the effects. We can, for example, run scenarios (detailed or high level) with various assumptions about the key factors driving outcomes. We then treat those computed outputs with care, remembering they are estimated outcomes based on assumed inputs. We see what we can learn from them, such as which inputs have the greatest effect on outputs. But we don’t necessarily treat them as reliable projections of expected future outcomes.

Mitigating

Here we move beyond pondering and analyzing to taking direct protective action. If we can eliminate the specific risk and it is a material threat, we do so. If we cannot, we look for opportunities to mitigate the risk or at least its effects. We take out insurance. We create internal control processes (and then we audit them). We train backups for key personnel in key processes. We enter into transactions, some simple and some complex, to hedge financial risks.

But in no instance would a prudent steward ignore or leave unaddressed a material identified risk threatening any aspect of the company.

However…

This does not mean that effective stewardship only involves protecting the company from risks.² Risk is inevitable. It cannot be eliminated.³

But even if all risk could be eliminated, that doesn’t mean doing so would be prudent or good stewardship. We take on risk to earn and create return, financial or otherwise:

• Bankers make loans knowing that not all borrowers will honor their commitments, but the income from those loans (net of losses related to the deadbeats) lets the bank pay interest to depositors, compensation to employees, and dividends or value appreciation to owners.
• We create families—marry and have children—knowing that family life will be challenging but also anticipating the joys that flow from those relationships over time.

The sweet spot

Prudent risk management involves seeking the just-right level of risk. Too little risk and we are missing value creation opportunities. A banker seeking a risk-free balance sheet will likely end up with a profit-free income statement. But too much risk and we are sowing seeds of value destruction.

COSO, an organization formed to help organizations design effective internal control environments and risk management practices, developed this graphic to demonstrate the risk-return balancing act.⁴

It’s something to think about

So we identify and monitor the material risks for our business, measure the ones we can, mitigate (to an appropriate degree) the most material ones, and constantly seek to move towards or stay in that sweet spot of maximum value creation relative to risks taken on. It’s challenging work, but steward leaders thrive on taking on those challenges.

Eric R. Alexander

May 2025

No A.I was employed (or harmed) in the creation of this content.

© 2025, Six Arrows Consulting. All rights reserved.

¹ Alan Murray, “What Makes a Great Board Director? It’s Hard to Define, but it Has Rarely Been More Critical,” Wall Street Journal on-line edition, May 18, 2025. (www.wsj.com/business/corporate-board-director-responsibility-cd8f1801)

² Christ’s parable of the talents in Matthew 25:14-30 explores this truth. The two servant-stewards who received the master’s grateful affirmation—“Well done, good and faithful servant!”—were those who fruitfully took risk for the master’s benefit. The one who hunkered down to protect, and only project, what had been entrusted to him faced a strong rebuke from the master.

³ A specific risk may perhaps be eliminated. But risk as a category of the reality we face in life cannot.

⁴ The Committee of Sponsoring Organizations of the Treadway Commission.