Three more structural choices, and the page in the board pack that should worry you most
By Elina Moshkovich
A warning can be accurate, well timed and delivered to exactly the right people and still change nothing at all.
Part III covered where the risk management function stands: whether it can reach a decision-maker, whether it arrives while options are open, and whether anybody is obliged to ask a hard question.
Even if all three work, the warning still has to become a decision. Three more structural choices determine whether it does.
4. Nobody is obliged to act
This failure begins with a familiar sentence. “The risk management function is dealing with it.” Usually, it is not.
It may be assessing the exposure, monitoring it, reporting it and chasing actions. It does not control pricing, underwriting, distribution or commercial negotiation. Yet organizations routinely create what I would call administrative ownership. A name appears against the item. An action has an owner. A due date is entered. The spreadsheet is satisfied. The exposure may be less impressed.
The loss ratio on a VMI line had been deteriorating for months. The indicator was amber. The register named the owner: the underwriting director.
He could not act alone. Repricing meant going through the sales team, which was under pressure to hold volume and had every reason to resist. Nothing in the framework said what an amber indicator required anyone to do, so the question became a negotiation between two functions with opposite incentives.
The argument was eventually settled. By then the product was deeply loss-making and the indicator was red.
The owner was named correctly. He simply did not own the decision that could change the exposure.
Boards usually ask, “Who owns this risk?” I would ask something more precise: “Who owns the decision that can change this exposure?”
Often there is no single name to write down. Concentration can span underwriting, reinsurance and distribution at the same time, while the register has room for one owner.
Ownership is only half the problem. The other half is what escalation actually triggers. A KRI crosses a threshold. An email goes out. The issue appears in the next committee pack. Everybody has been informed. Nothing necessarily changes.
Silicon Valley Bank offers an unusually explicit record. Breaches of its economic value of equity metric appear in the supervisory examinations of 2020, 2021 and 2022, and in 2020 an examiner proposed an advisory on the lack of escalation and remediation of breaches.¹ The breaches were not invisible. They were visible repeatedly, without timely correction.
Article 259 of the Solvency II Delegated Regulation requires reported information on material exposures to be taken into account in decision-making.² The operative words come at the end.
If an agreed threshold has no pre-defined consequence, it is not much of a threshold. It is a colour change.
5. The bonus rewards the behavior; somebody else carries the risk
Even clear authority can be defeated by incentives.
The underwriting director won his argument. He was still outmatched on the scoreboard: his counterparties were paid for volume, and the cost of the loss ratio would land in a different quarter, on a different line.
Risk management teams often leave this to HR and remuneration committees. They should not. Incentives can determine behavior more effectively than a risk appetite statement does, and regulators have been much less shy about the connection.
When Australia’s Royal Commission into financial services misconduct reported in February 2019, Commissioner Hayne was direct: sales, profit and commission structures had rewarded conduct that should not have occurred. His summary of the incentive problem was shorter: “self-interest will almost always trump duty.”³
Insurance was not a footnote. The Commission recommended prohibiting the hawking of insurance products outright.³
The OCC listed compensation and performance management that did not incentivize effective risk management among Citibank’s deficiencies.⁴ Remuneration design can itself be cited by a prudential regulator as a risk-management failure.
McKinsey’s 2025 data reinforces the incentive argument. Institutions that place the head of risk furthest from the chief executive also lag on risk-based compensation.⁵
PPI shows the scale of what can happen when product governance, sales practices and incentives all point in the wrong direction: more than 32.4 million complaints and over 38 billion pounds in redress in the United Kingdom.⁶
A risk appetite statement that the bonus scheme contradicts is not a constraint. It is a preference.
6. The dashboard is all green, which is the warning
The last structural mistake is the one I would test first if I had a single afternoon with a board. It is easy to miss because the page looks excellent.
Policies reviewed: green. Assessments completed: green. Actions closed: green.
Here is what I actually do with that page. In any sizeable, diversified portfolio, it is unusual for nothing material to be moving in the wrong direction. A loss ratio in one segment. Persistency in one channel. An assumption set two years ago and never revisited.
A persistently all-green board pack may tell you more about threshold calibration than about the health of the business.
There are only a few explanations, and none is comforting. The thresholds sit where nothing can cross them. The indicators measure what the risk function does rather than what the business is exposed to. The indicators look backwards, and deterioration has not reached them yet. Or something did cross and was “resolved” before it reached the board.
In one CRO role, an early review of the enterprise risk picture showed almost everything as green. I spent roughly three months reviewing the underlying assessments, challenging assumptions and recalibrating thresholds. By the end, the picture included both critical and medium-rated exposures.
The business had not become riskier in three months. The measurement had become more honest.
The tool is not the problem. In the Baker Tilly survey, 59 percent run enterprise risk management primarily on word processing and spreadsheets, and 21 percent on an integrated GRC platform.⁷ A spreadsheet can show movement; a sophisticated GRC platform can hide it. The design of the indicator matters more than the software behind it.
FERMA’s figures show how quickly visualisation is improving: interactive visualisation of risk maps rose from 33 percent of respondents in 2022 to 71 percent in 2024.⁸
Better visualisation sharpens the question: what exactly are we visualising?
A useful indicator starts with the business objective. If an insurer is growing through a new distribution channel, what has to stay true for that to work? Claims behaviour, persistency, fraud, partner concentration, capacity. Which indicator would show first that one of those assumptions is failing, and at what point should the decision be reopened?
Many dashboards start at the other end, with whatever the risk function already measures. The dashboard fills with indicators and still provides very little warning.
Few KRIs predict anything. The good ones do something more useful. They buy decision time.
A needle that never moves may say more about the instrument than the exposure.
Across these two articles, none of the six can be fixed by another policy, another committee or a more detailed register. They are about access, timing, the obligation to ask, authority, incentives and measurement.
A company can have an escalation policy and still have no mechanism for changing a decision. It can have hundreds of KRIs and still receive very little early warning.
The architecture is present. The connection is missing. That connection is what the Cassandra Watch is meant to create.
Structure is only half of the problem. Good governance can create access. It cannot create credibility.
PwC’s 2023 Global Risk Survey found that gap. In its CEE results, 51 percent of risk executives said they challenge senior management on strategy and risk appetite. Only 33% of CEOs and board members agreed.⁹
That 18-point gap is not a statistical curiosity. It is a relationship problem.
A CRO can have direct access and early involvement in material decisions and still find that the chief executive no longer finds the contribution useful.
Why does that happen, and what does it cost? Part V starts there.
NOTES AND SOURCES
- Board of Governors of the Federal Reserve System, Review of the Federal Reserve’s Supervision and Regulation of Silicon Valley Bank, April 2023, section on supervision by critical risk areas.
https://www.federalreserve.gov/publications/2023-April-SVB-Supervision-of-SVBFG-by-Critical-Risk-Areas.htm - Solvency II Delegated Regulation (EU) 2015/35, Article 259. Persons who effectively run the undertaking or hold key functions are to take into account the information reported as part of the risk-management system in their decision-making process.
https://www.eiopa.europa.eu/rulebook/solvency-ii-single-rulebook/article-5920_en - Royal Commission into Misconduct in the Banking, Superannuation and Financial Services Industry, Final Report, 1 February 2019, Volume 1, section 1.1, and Recommendations 4.1 and 4.3.
https://treasury.gov.au/sites/default/files/2019-03/fsrc-volume1.pdf - Office of the Comptroller of the Currency, consent order and 400 million dollar civil money penalty against Citibank N.A., 7 October 2020.
https://www.occ.gov/news-issuances/news-releases/2020/nr-occ-2020-132.html - McKinsey, Global GRC Benchmarking Survey 2025, based on 193 decision-makers.
https://www.mckinsey.com/capabilities/risk-and-resilience/our-insights/governance-risk-and-compliance-a-new-lens-on-best-practices - Financial Conduct Authority, Payment Protection Insurance Complaints Deadline: Final Report, April 2020. Over 32.4 million complaints and over 38 billion pounds of redress.
https://www.fca.org.uk/publication/ppi/payment-protection-insurance-complaints-deadline-final-report.pdf - Baker Tilly and the Internal Audit Foundation, Enhanced Enterprise Risk Management and Strategic Decision-Making, 2025. 567 respondents, surveyed January to February 2025.
https://www.theiia.org/globalassets/site/content/research/foundation/2025/enhanced-enterprise-risk-management-and-strategic-decision-making.pdf - FERMA, Global Risk Manager Survey 2024. 1,041 respondents from 77 countries.
https://ferma.eu/publications/global-risk-manager-survey-report-2024/ - PwC, Global Risk Survey 2023, CEE findings. 218 respondents in CEE within a global survey of 3,910 business and risk leaders.
https://cee.pwc.com/cee-findings-from-pwc-global-risk-survey.html
| THE CASSANDRA WATCH TEST Three questions on what happens to a warning
|
ABOUT THE AUTHOR
Elina Moshkovich is Founder of Risk University, a Board Advisor and Fractional CRO, and former Chief Risk Officer at Allianz and MetLife. She has more than 15 years of experience in senior risk and governance roles across insurance, banking and consulting. She advises boards, CEOs and senior executives on risk-management effectiveness, corporate governance and decision quality, with a particular focus on embedding risk management into strategic, capital and operational decision-making. Through Risk University, she also develops executive education for insurers and financial institutions. www.RiskUni.com
