Everything can be in place. The CRO reports to the board. The risk committee meets quarterly. The register is current, the appetite statement was approved last year, and the dashboard is green. And the company still walks into the exposure it had been watching.

Part I ended with Cassandra’s curse: the warning exists, but the decision proceeds much as it would have without it. The harder question is why. In practice, the answer often lies in how risk management is positioned, when the risk function becomes involved, and whether management is still genuinely open to changing course.

Some years ago, a sizeable life insurer was acquired by a banking group. A new senior management team arrived and asked each function head to explain what, exactly, their team contributed.