One of the fundamental roles of a board is to protect the organization. If you are serving on a board today, you know this is not a simple undertaking. You are governing an organization in an increasingly volatile, complex, uncertain, and ambiguous (VUCA) context. When Bert Nanus and Warren Bennis introduced VUCA to the world in 1985[1], one wonders if they realized how profoundly relevant the term would be forty years later.
Where previously the focus for many boards was on “small number of well defined, primarily financial risks,”[2], today your board needs to identify and study potential risks across the full scope of the organization. To effectively carry out its role to protect your organization, a board must develop risk acumen – an understanding of the extent and significance of current and potential future risks facing the organization.
Failing that, a board may find itself at the other end of continuum, constantly reacting to crises and producing a spin cycle that eventually produces organizational exhaustion. Risk acumen and a systematic design for studying potential risks helps build organizational resilience.
Developing risk acumen
Building risk acumen requires the board to design a system in which it first identifies and learns about possible future risks, and then uses a tool such as alternative future scenarios to examine the impact of a risk or the intersection of risks on the organization. To better grasp the potential repercussions, it helps to think about the scope of impact: Will it affect one or many organizational elements? How might the materialization of the identified risk(s) impact capability to achieve Ends [purpose]; staff and volunteers; beneficiaries (e.g., association members, participants, clients, students); the organization’s stakeholders; organization reputation; etc.? As evidenced by the pandemic, a significant disruption can have a complex and interconnected impact in an organization.
A board which has built its risk acumen will recognize the need to explore not only “high consequence – high probability” risks, but also “high consequence – low probability” risk. Risks from both types of scenarios may threaten critical organizational assets or even the organization’s existence, or require rethinking the results the organization should be producing.
Only through regular examination and study of risks will the board become more aware of the organization’s vulnerabilities, and better able to fulfill its role to protect the organization.
Translating a deeper understanding of risk to policy
As the board deepens its understanding of risk, it should consider how what it is learning should be reflected in its policies. Are there possible situations or conditions that would be imprudent in light of its deeper understanding of risks around, for example, cyber security? Should its Executive Limitations policies be revised? Is there a risk in low public transparency? Is it time to revisit its Governance Process policies around engagement with the community? Does the understanding of future possible risks suggest it is time to revise the results the board expects the organization to produce?
Risk acumen fosters organizational resilience
In a recent survey[3] of corporations about the impact of pandemic on organizational resilience – the ability of an organization to anticipate, prepare for, respond, and adapt to incremental change and sudden disruptions in order to survive and prosper[4] – strategic foresight capacities emerged as one the areas for improvement.
Today’s boards need to take heed.
[1] Bennis, Warren and Nanus, Bert. Leaders: The Strategies for Change. HarperCollins. 1985. Revised 2007.
[2] Alfonso Natale, Thomas Poppensieker, and Michael Thun. “From Risk Management to Strategic Resilience”. McKinsey & Company. (March 9, 2022)
[3] The survey was conducted by the Federation of European Risk Management Associations (FERMA) was supported by McKinsey. The results were published in “From Risk Management to Strategic Resilience” (McKinsey & Company. March 9, 2022)
[4] ISO 22316:2017 Organizational resilience – Principles and attributes – published in 2017