The Risk Your Board Can’t See Until It’s Too Late

Boards are generally very good at examining visible risk. Financial performance. Cyber exposure. Regulatory change. Geopolitical shifts. Concentration in major customers or supply chains. Succession planning for key executives.

These things appear regularly on board agendas, supported by papers, dashboards and external advice. They are tangible. They can be measured, discussed and, to a degree, controlled.

There is another form of risk that rarely appears with the same clarity.

What happens when the organisation loses the ability to respond?

A company can have a strong balance sheet, a coherent strategy and capable executives, and still be dangerously fragile. That is the difference between risk management and organisational resilience.

Risk management asks: What could go wrong, and how do we reduce the likelihood or impact?

Resilience asks: When something does go wrong, can we still adapt and operate?

Those are not the same question. You do not discover whether an organisation is resilient when everything is going well. You discover it when something goes wrong and people have to make decisions they have never made before.

THE INVISIBLE DEPENDENCY

Most boards review succession plans. Fewer test what actually happens when one or two critical people suddenly become unavailable. That matters because organisational dependency is not always obvious.

The dependency is knowledge.

One person knows how the system really works. One person knows the customer relationships. One person understands why a particular process exists. One person knows which numbers in the monthly report cannot quite be trusted. One person knows who to call when something goes wrong.

The organisation may have procedures, documentation and policies.

When that person leaves, everyone discovers how much of the real organisation lived inside their head.

That is a form of concentration risk. It simply doesn't appear on the risk register until the person is gone.

There is another form of dependency that can be even harder to see.

Decision dependency.

Some organisations are dependent on individuals not because those people hold unique knowledge, but because everyone waits for them to decide.

The CEO becomes the escalation point for everything. The CFO has to approve everything. The founder becomes the final arbiter. A senior executive has to be consulted before anyone is prepared to act.

From the outside, this can look like strong control. It may actually be organisational fragility.

The test of leadership is not whether the CEO can make every important decision.

It is whether the organisation can make good decisions when the CEO isn't in the room.

WHEN THE NORMAL PROCESS BREAKS

Most organisations are designed for normal conditions.

There are approval routes. Escalation procedures. Delegated authorities. Reporting lines. Meetings. Committees. Policies.

All of them have a purpose. Until the situation changes faster than the process can respond.

A major customer suddenly leaves. A critical supplier fails. A cyber incident spreads. A key executive becomes unavailable. A regulatory decision changes the economics of a business. A market moves in a direction nobody expected.

Or something happens that simply isn't covered by the playbook.

The question then becomes: Can people act?

Not theoretically.

Actually.

Do they know what they are allowed to decide? Do they know when to escalate? Do they have enough information? Do they trust their judgement? Will they be supported if they make the wrong call in good faith?

Or does everyone wait for someone more senior to tell them what to do?

An organisation can have excellent governance and still be incapable of moving quickly when the circumstances fall outside the governance manual.

That is not necessarily a failure of process. It may be a failure to build distributed judgement.

THE PROBLEM OF BAD NEWS

There is an even more human dimension to resilience.

How quickly does bad news travel?

A board can have excellent dashboards and still operate with a dangerously incomplete picture if people are afraid to tell management what is really happening.

People watch what happens when someone challenges a decision.

They watch how a difficult customer issue is received. They watch what happens to the person who says the strategy isn't working. They watch whether the executive who raises a problem is thanked for raising it or questioned for creating it.

Those experiences teach people what the organisation really values.

A policy might say that employees should speak up. Culture tells them whether it is safe to do so.

When people learn that uncomfortable information creates discomfort for the messenger, the information starts to move more slowly. Eventually, it may stop moving altogether.

When bad news travels slowly, the organisation loses something it can never recover: time.

By the time the problem reaches the people who can do something about it, the available options may have narrowed and the cost of responding may have increased dramatically.

This is why psychological safety is not simply a cultural issue. At board level, it is a resilience issue.

THE THREE DEPENDENCIES BOARDS SHOULD LOOK FOR

I would encourage boards to look beyond the conventional risk register and ask where the organisation is dependent on individuals rather than shared capability.

There are three areas I would examine.

1. Knowledge dependency

What happens if the person who knows how something really works is unavailable tomorrow?

Not just the CEO.

The engineer. The relationship manager. The operations specialist. The finance expert.

The person everyone quietly goes to when something doesn't make sense.

2. Decision dependency

What happens if the usual decision-maker isn't available?

Can the organisation still make good decisions at the appropriate level? Or does everything move upwards until it reaches someone with enough authority to make the call?

3. Information dependency

How quickly does uncomfortable information reach the people who need to know?

Does bad news move upwards quickly? Or does it become progressively softer as it travels through the organisation?

These three forms of dependency create the same underlying problem.

The organisation appears capable until the individual it depends upon isn't there.

That is when fragility becomes visible.

RESILIENCE IS NOT THE ABSENCE OF PROBLEMS

Resilient organisations are not organisations that avoid difficulty.

They are organisations that retain the capacity to respond when difficulty arrives.

That capacity is built in ordinary times. It comes from how decisions are made. How information moves. How disagreement is handled. How knowledge is shared rather than hoarded. How much authority people have to act.

How leaders respond when somebody gets something wrong while trying to do the right thing. How much of the organisation's capability sits in systems and shared understanding rather than individual heroics.

This last point matters.

Many organisations celebrate the person who can always fix the problem. The person who knows everything. The person who can get things moving when nobody else can. They become indispensable. That can feel like an asset. Sometimes it is a warning sign.

If one person has to be a hero every time the organisation encounters difficulty, the organisation has not necessarily built resilience. It may simply have built dependency.

The real objective should be to build an organisation where capable people can respond without needing a hero to rescue them.

THE TESTS A BOARD SHOULD RUN

Boards do not need another lengthy checklist. They need to test whether the organisation can function when the assumptions behind the normal operating model stop being true. I would start with three simple tests.

The absence test

What happens if a critical person is unavailable tomorrow?

Not just who replaces them.

What knowledge, relationships, judgement and decision-making capacity leave with them?

The disruption test

What happens when the normal process no longer works?

Who can decide? How quickly? With what information?

Do people know when they have the authority to act?

The truth test

How quickly does uncomfortable information reach this board?

What happens to the person who brings it?

Those questions may tell a board more about organisational resilience than another review of the risk register.

WHAT SHOULD THE BOARD DO WITH THE ANSWERS?

The board's role is not to run the organisation. It does have a responsibility to understand whether the organisation can function when circumstances change.

That means challenging management on more than succession charts and contingency plans.

Ask whether critical knowledge is shared. Ask whether decision rights are clear. Ask whether people can act without unnecessary escalation. Ask whether the organisation has rehearsed its response to serious disruption.

Most importantly, ask management: “What are you currently assuming will always be true?”

That is often where fragility hides.

The organisation assumes the CEO will be available.

The key supplier will continue supplying. The customer will renew. The system will remain operational. The experienced executive will stay. The information will arrive. The normal approval process will work.

Most of the time, those assumptions are reasonable.

Resilience begins when leadership understands what happens when they are not.

THE BOARD'S REAL TEST

There is a temptation to think of resilience as something the organisation needs during a crisis.

I think that gets it backwards. Resilience is built long before the crisis. It is built every time a leader gives someone the authority to make a decision.

Every time knowledge is shared rather than protected. Every time someone raises an uncomfortable truth and is listened to. Every time a board asks what happens if a key person is suddenly unavailable. Every time an organisation removes unnecessary dependency on a single individual.

The crisis simply reveals whether that work has been done.

The most important question for a board is not: “What are our biggest risks?”

It is: “Where is our organisation more dependent on individuals, assumptions and informal knowledge than we realise?”

If something went seriously wrong tomorrow, the board may discover that its greatest risk was never the event itself.

It was the organisation's ability to respond to it.

That is the risk that is hardest to see until it is too late.