DE
FR
IT
العربية
Contents 5
- What is the purpose of risk management in an organisation?
- How does the board recognise whether risk management is a means or an end in itself?
- What does the example of AI risks in the European financial sector show?
- How can this logic be conveyed to the board in practice?
- What is the first step for the next board meeting?
In the boardroom, risk management is easily misunderstood as a compliance exercise that fills registers and produces reports. GRC analyst Michael Rasmussen of GRC 20/20 Research reminds us that risk management only fulfils its purpose when it improves decisions and makes objectives achievable under uncertainty. For the board, a different yardstick than completeness is therefore worthwhile: how often a piece of risk information has actually led to a decision.
Risk management is not justified by the completeness of a register, but by whether it helps the board of directors make better decisions under uncertainty. Anyone who wants to demonstrate this value to the board must link risk information to concrete decisions and objectives rather than to reporting duties. Recent examples, such as the warning issued by the European financial supervisory authorities on AI-related ICT risks, illustrate how governance is meant to create decision-making capability rather than documentation.
What is the purpose of risk management in an organisation?
Risk management serves to improve decisions under uncertainty and make the achievement of corporate objectives more reliable, not to maintain a register.
Michael Rasmussen proposes a simple test for risk owners and boards of directors. What matters is whether registers, controls, assessments, analytics, models, reporting and technology actually help make better decisions and reliably achieve objectives under uncertainty. If the answer is negative, Rasmussen argues, the question arises why the effort is being made at all.
Administrative duties around risk management do not disappear as a result. Supervisory authorities expect reports, boards need information, policies must be maintained, and controls and assessments must be documented. The problem arises when this administration replaces actual steering rather than supporting it.
How does the board recognise whether risk management is a means or an end in itself?
The board recognises the difference by whether a risk report leads to a traceable decision or merely documents what is already known.
Rasmussen describes a common pattern: organisations can become extremely efficient at producing risk information that nobody uses for decisions. For the board, this translates into a concrete test question for every risk agenda item.
A concise set of criteria that the board can apply to every risk submission is helpful. The Chief Risk Officers Outlook 2024 shows that many risk functions are working on exactly this link between reporting and decision-making.
- Is the submission linked to an upcoming decision for which it is actually used?
- Would a missing metric actually prevent a concrete action, or would it only leave a report incomplete?
- Does the discussion in the board lead to an adjustment of strategy, limits or resources?
What does the example of AI risks in the European financial sector show?
The European financial supervisory authorities are not demanding additional documentation for its own sake, but governance structures that enable institutions to actually respond to new risks.
The European supervisory authorities EBA, EIOPA and ESMA call, in a joint statement, for a cross-sectoral, risk-based and consistent supervisory approach to mitigating the ICT risks posed by frontier AI models. The focus is not the reporting itself, but the ability of institutions to act.
The statement emphasises that financial institutions should have robust governance and risk management structures in place to effectively support the management and mitigation of these risks. This is the same logic that should apply at board level: structures exist so that decisions can be made in an actual event, not so that a file is complete.
How can this logic be conveyed to the board in practice?
It is most effective to present risk information in the language of objectives, limits and courses of action rather than in the language of controls and percentages.
Instead of presenting a heatmap with many cells, it is worth asking which three risks could actually endanger the current strategy and what course of action the board has in response. This shortens the agenda item but sharpens its decision relevance.
The Global Risks Report 2026 analysis shows, by way of example, how global risk trends can be broken down into a few questions relevant to an individual company. The board should demand this kind of distillation from the risk function, rather than mistaking it for completeness.
A risk report that does not lead to any decision has failed its purpose, even if it was delivered complete and on time.
What is the first step for the next board meeting?
The first step is a one-off review of the last risk agenda items for their decision impact, carried out by the risk function and signed off by the chair of the board.
The risk owner checks, ahead of the next ordinary meeting, which of the last five risk agenda items led to a documented decision and which were merely noted. The result is presented to the chair of the board as a brief overview.
On this basis, the format of the next risk reporting can be adjusted in a targeted way: less completeness, more decision relevance. An overview of current regulatory developments supports this prioritisation, for instance through the Swiss GRC news overview.
Frequently asked questions
How can you tell that a risk register serves documentation only?
A risk register primarily serves documentation when reports are delivered complete and on time without leading to a traceable decision in the board. Rasmussen points out that organisations can efficiently produce risk information that nobody actually uses for decisions. That is the real warning sign.
Which criteria should the board apply to risk submissions?
The board should check whether a submission is linked to an upcoming decision, whether a missing metric would actually prevent an action, and whether the discussion leads to an adjustment of strategy, limits or resources. These three questions replace completeness as the yardstick for the quality of a risk submission.
What do EBA, EIOPA and ESMA demand from financial institutions regarding AI risks?
The three European supervisory authorities call for a cross-sectoral, risk-based and consistent supervisory approach to mitigating ICT risks posed by frontier AI models. Financial institutions should have robust governance and risk management structures in place that effectively support the management and mitigation of these risks, rather than merely generating additional documentation.
How does a decision-relevant risk report differ from a plain status update?
A decision-relevant risk report names a small number of risks that actually endanger the current strategy and shows concrete courses of action for the board. A plain status update, by contrast, lists many metrics or a complete heatmap without any resulting adjustment to strategy, limits or resources.
What first step can the risk function take before the next meeting?
The risk function can check, ahead of the next ordinary meeting, which of the last five risk agenda items led to a documented decision and which were merely noted. The result is presented to the chair of the board as a brief overview and serves as the basis for a decision-oriented reporting format.
- The Prime Directive of Risk ManagementGRC 20/20 Research
- Joint statement on ICT risks from frontier AI modelsEuropean Banking Authority
