Risk Management Isn’t Fear Management

The longer I spend working as an independent governance, risk and compliance consultant, the more I find myself thinking that many organisations aren’t actually managing risk.

They’re managing fear.

The two are not the same thing.

Spend enough time in boardrooms, executive meetings and governance discussions and you’ll notice something curious. Conversations almost always begin in exactly the right place. A business wants to expand into a new market. A board needs to make a strategic decision. A manager wants to resolve a difficult employment issue. A compliance team is navigating regulatory change. There is an objective, a direction of travel and a sense of what the organisation is trying to achieve.

Then, somewhere along the way, the conversation changes.

Almost imperceptibly, the objective fades into the background and is replaced by a different question entirely.

“How do we make sure this doesn’t happen?”

On the face of it, that sounds like responsible leadership. Organisations should think carefully about legal exposure, regulatory expectations, operational resilience and reputational risk. Those considerations matter, and any leadership team that ignored them would rightly be criticised. But the longer I spend working with clients, the more I question whether we’ve misunderstood what risk management is actually for. Increasingly, I leave meetings with the feeling that organisations haven’t failed to identify risk at all. They’ve simply become so consumed by one particular risk that it quietly replaces the objective they were trying to achieve in the first place.

One of the unexpected privileges of consultancy is perspective. Every organisation believes its problems are unique, and in many respects they are. The personalities are different. The commercial pressures are different. The regulatory landscape is different. Yet when you’ve had the opportunity to work across family offices, banks, law firms, trust and corporate service providers, start-ups and established businesses, the individual facts become less interesting than the patterns beneath them. The same conversations emerge in different forms, the same concerns surface under different names and the same shift in thinking appears with remarkable consistency.

Somewhere during the discussion, the organisation stops navigating towards an outcome and starts navigating away from a fear.

That fear isn’t always legal. Sometimes it’s regulatory. Sometimes it’s financial. Sometimes it’s reputational. Sometimes it’s simply the fear of making the wrong call. Whatever form it takes, it has an extraordinary ability to become the loudest voice in the room. I’ve often found you can tell exactly when it happens because the questions begin to change. Nobody is asking, “Will this help us achieve what we’re trying to achieve?” They’re asking, “Will this get us into trouble?” Those questions sound remarkably similar. In practice, they’re worlds apart.

A discussion about reasonable adjustments for a disabled employee brought that home to me more clearly than any textbook ever could. What struck me wasn’t anybody’s attitude. There was no lack of empathy, no reluctance to support the individual and certainly no desire to ignore legal obligations. Quite the opposite. Everyone involved wanted to do the right thing. Yet as the discussion unfolded, the employee themselves gradually disappeared from the conversation. Instead, the room became preoccupied with a series of entirely understandable questions. What if the adjustments were expensive? What if they created a precedent? What if similar requests followed? What if they agreed to something that proved difficult to sustain?

Individually, every one of those questions was reasonable.

Collectively, they changed the purpose of the discussion.

The process had quietly become more important than the purpose.

The objective was no longer to understand what this individual needed in order to perform their role successfully while meeting the organisation’s legal obligations. The objective had become avoiding the possibility of making the wrong decision. The irony is that this often creates the very outcome organisations are trying to avoid. Conversations that begin with a desire to minimise legal exposure can end up increasing it because trust deteriorates, relationships become strained and opportunities to resolve concerns early are lost. The perceived risk eclipses the actual one.

Once I’d recognised that pattern, I realised I was seeing it everywhere. I’ve watched boards postpone replacing ageing technology because approving a significant investment felt uncomfortable, only to authorise a much larger emergency expenditure after a system failure. Technology has a remarkable habit of reminding people that replacing it wasn’t nearly as expensive as not replacing it. I’ve seen organisations delay engaging openly with regulators because they wanted one more piece of information before starting the conversation, only to discover that silence rarely creates confidence. I’ve watched leaders postpone difficult conversations with employees because they didn’t want to upset them, when months of uncertainty proved infinitely more damaging than twenty minutes of honesty. On the surface these situations have very little in common, yet beneath them sits exactly the same pattern. The organisation has stopped asking what it is trying to achieve and become absorbed by what it is trying to avoid.

The more I think about it, the more I believe we’ve unintentionally narrowed the purpose of governance itself. We talk about compliance, assurance, oversight and control as though they were the destination, when in reality they are simply tools. Governance has never existed to help organisations avoid criticism. It exists to help organisations make better decisions. Risk management was never intended to replace strategy. It was intended to inform it.

That distinction matters far more than it first appears.

When avoiding legal claims becomes the objective, employment issues become exercises in self-protection rather than opportunities to build capable, inclusive workplaces. When avoiding regulatory criticism becomes the objective, engagement with regulators becomes defensive rather than constructive. When avoiding reputational damage becomes the objective, transparency often disappears at exactly the moment it is needed most. Risk stops informing judgement and starts replacing it.

Perhaps that’s why I now find myself asking clients the same question so often.

“What does success actually look like?”

It’s a deceptively simple question, but it has an extraordinary habit of changing the conversation. Once people start describing the outcome they genuinely want to achieve, the legal considerations, commercial realities, operational constraints and regulatory obligations don’t disappear, nor should they. They simply return to their proper place. They become factors to be weighed rather than the destination itself.

I’ve come to think that organisations rarely get into serious difficulty because they don’t care about risk. More often, they get into difficulty because they care so deeply about one particular risk that they lose sight of everything else. Their field of vision narrows. Decisions become increasingly defensive. Leadership becomes an exercise in avoiding blame rather than exercising judgement.

Good governance has never been about eliminating uncertainty. It has always been about helping organisations make better decisions in spite of it.

Which is why, increasingly, I think one of the most valuable questions any board, leadership team or manager can ask isn’t:

“What are we trying to avoid?”

It’s:

“What are we trying to build?”

Because the organisations that make the best decisions aren’t the ones that spend all their time steering away from danger.

They’re the ones that never lose sight of where they’re trying to go.

They’re not playing not to lose.

By Mitzi Danielson-Kaslik MICA CG, Risk, Governance & Compliance