Risk as the language of the boardroom, not a compliance ritual
NUNO FERNANDES
A multimillion-dollar investment is on the table. Directors are engaged, prepared and asking questions. The discussion is substantive. On the surface, the session looks exactly as it should. But as it unfolds, something becomes clear: the questions being asked are almost exclusively operational. They center on cost overruns, execution timelines and budget contingencies. These topics are entirely legitimate, yet wholly insufficient.
Nobody asks about supplier lock-in. Nobody wonders what happens if the underlying technology evolves, or is displaced, over the investment horizon. Nobody challenges the competitive assumptions embedded into the returns model. The board covers risk thoroughly, just not the risks that could actually determine whether the investment succeeds or fails.
I'm not describing a negligent board, but one that is very common. And the distinction matters, because the solution is not to turn non-executive directors into permanent skeptics who challenge every management assumption in every session. That would be its own failure: exhausting, counterproductive and, ultimately, adding no value. Good risk governance requires something more demanding than reflexive challenge. It requires judgment about when to go deeper; humility about the limits of what a board can see from the outside; and the discipline to ask the hardest questions precisely when the room feels most settled.
Risk Is a Strategy Conversation
In some boards, risk tends to be treated as a parallel track. Strategy is discussed first, followed by risk, tipically reviewed by a subset of directors, through a structured report or heatmap.
But every strategic decision is already a risk decision. Choosing to enter a market, acquire a company, commit to a technology platform or lock in a supplier relationship all embed assumptions about uncertainty. If those assumptions are not challenged at the moment when decisions are made, a separate technical risk process will rarely catch what really matters.
Well-functioning boards do not separate strategy and risk. They treat them as a single question. This requires non-executive directors who are genuinely fluent in strategic risk, not as technical specialists, but as experienced challengers of management's assumptions.
What Boards Consistently Miss
When reporting is mistaken for understanding, boards often feel most comfortable precisely when they should be most alert. Some risks are often underweighted by boards.
The first is strategic and technological risk, precisely what was absent from the boardroom discussion I described earlier. When boards engage with technology, they tend to ask operational questions: "Is the implementation on track?" or "Are costs within budget?" These are legitimate queries, but the wrong ones to lead with. More important questions are: "Is this the right technology?" "Are we creating dependencies we do not fully understand?" "What will the competitive landscape look like in five years if this technology is commoditized or made obsolete?"
Time horizon is another often overlooked risk. Median CEO tenure in the S&P 500 has fallen by 20% over the past decade to less than five years. Executives are not short-termist by nature. They are responding rationally to the pressures of their own situation. Boards are supposed to provide the counterweight by taking a long-term view. Yet in practice, many drift into the same time frame.
The final risk is culture. Since this is treated as intangible, it is often left unaddressed. But cultural signals (unwillingness to escalate problems, absence of internal dissent, management teams that are never wrong) are among the earliest indicators of serious risk. In the cases that have defined corporate governance failures over the past two decades, from Volkswagen to Wells Fargo, the cultural and incentive distortions were visible long before the outcomes. The boards were not necessarily missing information; they were missing the habit of paying attention to the right signals.
From Oversight to Ownership
The difference between resilient boards and fragile ones is not the sophistication of their risk architecture. It is the quality of the questions asked, and the willingness to ask them, especially when performance looks strong.
The boardroom I described at the outset did not have a risk gap in any formal sense. The agenda included risk. There was an internal risk department. The pack had been prepared. What was missing was the willingness to look past the prepared material and ask what it was not showing.
If you chair a board or sit as a non-executive, the practical implication is straightforward. Next time a significant investment or strategic commitment comes to the table, notice the shape of the conversation. Are the questions focused on execution issues such as timelines, budgets and operational detail? If so, someone needs to elevate the discussion to strategic topics. What are the assumptions about the market, the technology and the competitive landscape in three to five years? Are we creating dependencies we don't fully understand? What would have to be true for this decision to look clearly wrong in hindsight?
You don't need a revised risk framework to do this. You need the habit of asking the uncomfortable question when the room feels most settled, which is usually when it matters most.
NEWS&TRENDS.
The Committee of Sponsoring Organizations (COSO) has released the publication Corporate Governance: Guiding Principles for Board Oversight, which sets out 12 principles to help boards strengthen governance and oversight in an increasingly complex business environment. The framework aims to provide practical guidance on board composition, accountability, strategy, culture, succession planning and risk oversight to support long-term resilience and competitiveness. Read the full guide here.
EY’s latest CEO Outlook Global Report, based on a global survey of chief executives, suggests that companies are responding cautiously to a volatile environment while continuing to pursue strategic investment priorities. Alongside efforts to reinforce financial resilience, CEOs are focusing on areas such as partnerships, targeted acquisitions, AI and digital capabilities, workforce efficiency and supply-chain transformation to sustain long-term competitiveness. Read more here.
Russell Reynolds Associates’ latest Global CEO Turnover Index reports a continued rise in CEO departures worldwide. The report highlights shorter CEO tenures, increasing scrutiny of performance and succession, and a stronger emphasis on leadership capable of driving transformation and long-term resilience. Read more here.
A new article by IESE professor Álvaro San Martín draws on insights from the chairperson panel at the IESE–ECGI Corporate Governance Conference, held in Madrid on March 16, to examine what responsible ownership means for family businesses in times of disruption. Reflections from Sabina Fluxá (Iberostar Group), Paco Riberas (Gestamp) and Gildo Zegna (Ermenegildo Zegna Group) underscore the value of long-term commitment, strong governance and purpose-driven leadership. Read here.
IESE's recent research.
DAI, J., ORMAZABAL, G., PEÑALVA, F., RANEY, R. (2026). Mandatory investor disclosure, sustainability commitments, and portfolio decarbonization. Journal of Accounting and Economics, 81 (1), Article 101817.
BOULONGNE, R., YOUNG-HYMAN, T., BERRONE, P. (2026). Short-term demands and long-term commitments. A Temporal model of stakeholder governance. Academy of Management Journal.
We care about sending you only the information that matters to you. Click the button below to access your preferences page and tailor the content you want to receive from us.
