Risk management · Decision-making · Arbitration
Risk: take the right risks, don't avoid them
A risk management function's mission is not to reduce risks to a minimum. Its mission is to help the organisation take the right level of the right risks, knowingly. This nuance changes the nature of the framework — and the way the business lines perceive it.
In many organisations, risk management is perceived as a hindrance: it flags what could go wrong, demands additional controls, and slows down projects. This perception is not unfounded — it accurately describes certain frameworks.
Managing uncertainty
Not just protecting oneself against it
Inform decisions
The usefulness criterion of a device
The foundational misunderstanding
Yet it is based on a mistake. An organisation that takes no risks pursues no ambitious goals. Taking too few risks is a management failure just as much as taking too many: both compromise the achievement of objectives. The useful function does not minimise risk; it illuminates the level taken, and verifies that it corresponds to the board's direction.
The real criterion: the decision
A risk management system is judged by a simple question: Are the organisation's decisions better informed thanks to him? If risk information arrives after the decision, or in a format that the decision-maker cannot use, the system produces documentation, not value.
This presupposes risk management that is present upstream — in investment committees, project reviews, outsourcing decisions — and not merely in an annual mapping cycle.
Mapping: a management tool or an inventory?
Risk mapping is the most widespread — and the most frequently misused — instrument. Two main pitfalls dominate.
The first is the'inventory several hundred risks identified, rated, classified and updated once a year. Exhaustiveness replaces prioritisation, rendering the document unusable for a leader.
The second is the ceremonial quotation : scales applied without a shared definition, where «high impact» does not cover the same reality from one function to another. Comparison then becomes illusory.
Useful mapping is brief, aligned with objectives, based on defined scales and updated when reality changes — not according to a fixed schedule.
Risks are competing for resources
One seldom-formalised aspect deserves attention: risk treatments compete with one another. The resources allocated to managing one risk are not available elsewhere. Strengthening a control framework, recruiting expertise, acquiring a tool: every decision consumes scarce resources.
This observation shifts the question. It is no longer just a matter of knowing whether a risk is being properly dealt with, but whether the universal benefit is consistent with the priorities. It is a governance trade-off, which requires a consolidated view — and which remains impossible as long as each function thinks only within its own scope.
Emerging and cross-cutting risks
Conventional systems handle known risks and those attributable to a department properly. They struggle to capture two decisive categories nonetheless: emerging risks, which do not yet have a history, and the cross-cutting risks, which do not fall under the responsibility of any particular person.
The latter are often the most significant — reliance on a critical supplier, a group's cumulative exposure, cascading effects of a technical failure. Addressing them requires a deliberate exercise: bringing the functions together, examining interdependencies, appointing a lead. Without this approach, they remain the blind spot of the framework.
This consolidated view becomes easier to maintain when risks, their assessments and their treatments are tracked in a common environment. The tool can then support mapping, link mitigation measures to the risks concerned, and make responsibilities, deadlines and trade-offs visible — without replacing the judgement upon which they are based.
Common pitfalls
- Confusing risk management and risk reduction.
- Produce an exhaustive mapping at the expense of prioritisation.
- Unscaled, rendering comparisons misleading.
- Intervening after the decisions rather than beforehand.
- Ignore the competition between treatments and the global allocation of resources.
- Leaving cross-functional risks without an identified owner.
The ARCAD approach
ARCAD builds risk management devices linked to objectives and calibrated to inform decisions: streamlined mappings, defined scales, alignment with committees where trade-offs are made, and explicit treatment of cross-functional risks. The aim is not to list more, but to decide better.
Refocus your risk framework on decision-making.
ARCAD reviews mappings, scales and alignment with your decision-making bodies.