Why so many risk systems look complete but change so little
Part I ended with Cassandra’s curse: the warning exists, but the decision proceeds much as it would have without it. The harder question is why. In practice, the answer often lies in how risk management is positioned, when the risk function becomes involved, and whether management is still genuinely open to changing course.
Why the system gets stuck
Formal risk-management structures are unavoidable in a regulated insurer. The problem starts when maintaining them becomes most of what the organisation sees the risk function doing: Policies. Assessments. Committee cycles. Regulatory exercises. Reporting. If senior management rarely sees this work alter an important business decision, risk management gradually becomes associated with compliance rather than with better management.
ORSA shows what happens next. In many companies it became an annual document. It is produced, reviewed, submitted and filed. The board reads it once a year, usually after the strategy it was meant to test has already been approved. The right instrument, running a year slow.
And where no supervisor asks for it, it is often not done at all. In 2024 the IAIS reviewed how 67 supervisory authorities apply ICP 16. On the ORSA standard, 28 percent were assessed as not observed, the second highest rate of non-observance in the review. Several had no requirement, or even a communicated expectation, that insurers perform the assessment regularly.¹
The same thing happens one level up, to the function itself. Inside the regulated perimeter it is required. Outside it, it is a choice.
In the insurance markets I work in, the line is visible. Where the supervisor requires an independent risk function, insurers have one. Where the supervisor does not require it, most do not. In some of them the title exists. The independence does not.
In many non-financial industries, there is no equivalent regulatory requirement for an independent risk function, and a 2025 survey of 273 US organisations across industries, by North Carolina State University and the AICPA, found 45 percent with a chief risk officer or equivalent.² That tells us who the architecture was built for.
The consequences compound, and they feed each other. The risk function is involved later. Investment in people, data and analytical capability becomes harder to justify. The CRO is asked for an opinion when the proposal is already mature, senior sponsors are committed and money, time and reputation have already been invested.
Management eventually asks the same question I was asked years ago: what are we getting from the risk function that the other functions do not already provide?
And the answer is too often evidence of more activity. Another report. Another dashboard. I have seen an 800-line risk register that nobody in the company could connect to a decision. It was, everyone agreed, extremely thorough.
The people running these systems say much the same thing. In the same survey, 11 percent described their risk-management process as mostly or extensively a strategic tool, 64 percent said it delivers no advantage or a minimal one, and 32 percent called their risk oversight mature or robust.
These are the numbers of a discipline that has been installed rather than adopted.
Compliance becomes the easiest contribution to defend because it is the easiest one to prove.
When the risk function arrives too late
Consider a large distribution partnership at an insurer. The commercial case is attractive. Negotiations have been running for months. Resources have been reserved. The launch date is already being discussed externally.
Then the risk function is asked for its assessment.
The team may identify concentration exposure, conduct concerns, operational constraints, fraud scenarios, claims uncertainty and reinsurance implications. The analysis may be excellent.
But the organisation is already committed. Months of work have gone into the proposal. Senior executives have supported it. Commercial expectations have been created. Budgets may depend on it.
So, the important question is no longer whether the risk function has identified the right issues. It is: what can still change? Can the deal be restructured, or real limits introduced? Is walking away still an option anyone would consider?
If the answer is effectively no, the assessment has arrived at the end of the decision rather than the beginning.
The warning was never the hard part. The hard part is making it arrive while the answer to that question is still yes. That is the job of a watch. Without one, risk management is reduced largely to documenting and containing a decision that has already been made.
Timing is not the only thing that has to work. Useful warnings rarely arrive at convenient moments, and they often challenge projects in which influential people have already invested credibility.
Bad news has to be allowed to travel before it has been polished into certainty. Whether it does depend on what senior management and the board are prepared to hear, and on whether they trust the person bringing it. No standard can create that. It is a subject in itself, and I will come back to it.
There is, however, one thing a CRO can do about this without a new mandate, a new committee or anyone’s permission.
Take one material decision from the past six months. Reconstruct the timeline. When did the risk function first see it? What could still have changed at that point? What actually changed?
Run that test on yourself before someone else runs it on you. In my experience, few do. And it produces the only evidence that answers the question I was asked in that meeting.
What a board should ask instead
Risk-management maturity is often assessed by looking at what the organisation has built.
A board can learn more by asking what changed because the system was there.
One question does most of the work. Which material decision in the past six months changed because of risk information or challenge?
Then examine what happened. The box accompanying this article sets out the follow-up questions.
They are harder to answer than whether a policy was reviewed on schedule. That is why they tell us more.
Insurance companies are professional risk takers. They employ sophisticated actuarial models, underwriting expertise, reinsurance programmes and capital-management capabilities.
Yet an insurer may be highly disciplined in assessing the risks it takes onto its balance sheet and much less disciplined in examining the uncertainty created by its own strategy and management decisions.
Enterprise risk management is supposed to close that gap.
I think of an effective risk-management system as part of the company’s decision-making process. It connects what the company is trying to achieve with the assumptions behind those plans. It shows when an important exposure is changing and makes sure that information reaches someone who can act while meaningful choices still exist.
It cannot predict the future. Nor should it make decisions for management.
Its job is to prevent an important warning from getting lost somewhere between information and action.
Throughout this column I will call such a system the Cassandra Watch.
By Cassandra Watch, I mean a risk-management system that connects an emerging warning to challenge, escalation and a decision while there is still time to act.
Executive trust follows the same logic. It is extended to a function that changes outcomes, and quietly withdrawn from one that only documents them.
The risk profession has already shown that it can build frameworks, policies, committees and reporting systems. The harder question is whether the company would make worse decisions if all of that disappeared.
In the next article I will look at why the answer is so often no. The explanation often lies less in individual competence than in a small number of structural choices that quietly remove the risk function from the decision: where the CRO reports, when the function is invited, and who is allowed to hear bad news first.
NOTES AND SOURCES
- IAIS, Aggregate Report of the Peer Review Process on Enterprise Risk Management for Solvency Purposes relative to ICP 16, October 2024. Sixty-seven supervisory authorities participated. iais.org
https://www.iais.org/uploads/2024/10/Aggregate-Report-of-Peer-Review-of-Enterprise-Risk-Management-for-Solvency-Purposes-relative-to-ICP-16.pdf - North Carolina State University ERM Initiative and the American Institute of Certified Public Accountants (AICPA), 2025 State of Risk Oversight, 16th edition. A survey of 273 US organisations across industries, conducted in spring 2025; respondents were chief financial officers and senior finance leaders. erm.ncsu.edu
| THE CASSANDRA WATCH TEST Five questions for your next risk report
|
ABOUT THE AUTHOR
Elina Moshkovich is Founder of Risk University, a Board Advisor and Fractional CRO, and former Chief Risk Officer at Allianz and MetLife. She has more than 15 years of experience in senior risk and governance roles across insurance, banking and consulting. She advises boards, CEOs and senior executives on risk-management effectiveness, corporate governance and decision quality, with a particular focus on embedding risk management into strategic, capital and operational decision-making. Through Risk University, she also develops executive education for insurers and financial institutions. www.RiskUni.com
