01/09/2026
BOARDROOM REFLECTIONS
Reflection No. 7
Risk is Everyone’s Business
Risk management is sometimes mistakenly viewed as the responsibility of the combined assurance functions, rather than a responsibility shared across the organization.
Every person in an organization makes decisions that can create, prevent, increase, or mitigate risk.
A board considers strategic and emerging risks.
Management translates strategy into action and manages the risks that arise from operations.
Employees make decisions every day that can affect customers, finances, information, reputation, compliance, and ultimately the sustainability of the organization.
Effective risk management therefore cannot be an annual exercise where a risk register is reviewed, ratings are updated, and the matter is put aside until the next reporting cycle.
Risk evolves as the organization evolves.
New opportunities create new risks; changes in the operating environment create new exposures; and decisions made today can create consequences that may only become visible tomorrow. This therefore means that risk management must be embedded in strategy, decision-making, operations, and organizational culture.
Before approving a major strategic decision, some of the key questions are:
- What could go wrong?
- What are we assuming?
- What are the consequences if those assumptions are incorrect?
- Are we taking the right amount of risk to achieve our objectives?
- What controls are necessary to manage the risk?
It is important to highlight that effective risk management does not mean avoiding risk altogether. Organizations must take risks in order to grow. However, the objective is to understand the risks that are being taken; the appropriateness thereof; and ensure that the organization has the capacity to manage them.
A strong risk culture exists when people feel responsible for identifying and escalating risks; and not when they are afraid to talk about them.
Silence does not eliminate risk. It simply delays the organization’s opportunity to respond.
- For boards, this means looking beyond the risk register and asking whether risk management is genuinely embedded in the organization’s decision-making and culture.
- For management and employees, it means understanding that risk ownership is not delegated to a department. It is shared across the organization.
A risk register can tell you what risks you have identified. A strong risk culture determines whether you identify the risks you haven’t.
Reflection
If your organization’s risk register disappeared tomorrow, would people across the organization still know what risks they are responsible for managing?
Nohlanga Silwana Motaung
Founder | Corporate Governance, Legal & Board Advisor
PNM Services
Empowering organizations through governance excellence, legal expertise, and ethical leadership.