From risk registers to strategic resilience

Organizations are still asking risk teams to profile the future but more importantly, they are asking how the risk function can help them be more resilient to future shocks. There is a more pragmatic expectation of risk teams – resilience as a core element of strategy.

This shift is visible across many markets. Traditional business models are under pressure in places that once felt stable. For example, education is an obvious datapoint. Long considered a staple for business advancement, providers of educational degrees and professional certifications are finding that the landscape is changing. Buyers are more selective, less convinced of long-term value, and increasingly sensitive to cost.

Organizations are repositioning how risk is presented and where it sits in the conversation. Stakeholders are fatigued by the constant emphasis on the downside of risk and its predominate framing as a warning or an opposition to opportunity. It can feel like maintaining inertia rather than offering guidance. There is appetite to move risk closer to the center of executive decision-making, but not in its traditional form. The emphasis is no longer on controls or compliance. Instead, it is on how an organization can withstand disruption while remaining capable of acting on opportunity. Risk management will need to contribute to innovative thinking to fully support strategy.

The current environment, particularly in geopolitics, has exposed the limits of conventional approaches to scenario analysis. There are often multiple plausible futures unfolding at once, each with its own internal logic. Probabilities can shift quickly, and what once felt like a stable “base case” is increasingly difficult to define. We can point to numerous examples that seemed improbable only weeks ago but have now materialized.

This example highlights the changing purpose of scenario analysis. It is less about assessing probabilities and more about structuring conversations and contributing to strategic narratives. The value lies in testing how an organization would respond under different conditions, not in selecting the most likely outcome. The discipline becomes one of preparedness: identifying decision points, clarifying actions, and understanding where the organization may be exposed. The focus shifts away from imagining the incident itself and towards what follows. Leaders want to know how well their firms are positioned to adapt, how quickly they can execute their strategies, and whether they will be able to assess their effectiveness.

This change in perspective is closely tied to a broader recognition that risk is increasingly systemic. It is apparent that events do not occur in isolation but have deep cascades. For example, geopolitical tension can alter trade flows, which in turn can disrupt supply chains and have pricing and availability implications. What matters is not only the event, but the underlying driver and the pathways through which it travels. More structured approaches are beginning to emerge to capture this. Concepts such as “geopolitical distance” offer a way to move from intuition to analysis. Many organizations have long been aware of these dynamics, but fewer have had a way to quantify them and embed them into strategy.

A similar reframing is taking place in the discussion of climate. The issue has not disappeared, but its emphasis has already shifted. Businesses are arguably now focused on climate adaptation versus decarbonization. Challenges such as how to finance it, how to operationalize it, and how to make it tangible are now the topics of conversation. As part of the adaptation strategy, there is also growing interest in nature-based solutions for their potential to influence pricing and risk transfer mechanisms. The conversation is becoming less about theoretical aspirations and more about near-term resilience.

Diversification is becoming more difficult as past assumptions of correlations are weakening. Sectoral correlations are rising across asset classes whereas those related to geographies are proving to be less reliable. Organizations are finding that these shifts in correlations are reducing the effectiveness of diversification. At the same time, critical systems are becoming more interconnected. AI infrastructure, data centers, and supply chains are deeply linked, yet they are often analyzed separately. Some financial institutions, in particular, are largely organized along sectoral lines, which makes it difficult to see across these interdependencies. The result is a widening gap between the complexity of the system and the structures used to understand it.

Resilience, in this environment, is not something that can be achieved through isolated improvements. It requires sustained effort across an entire ecosystem. An organization’s strength is determined not only by its own capabilities, but by the reliability of its suppliers, the robustness of its infrastructure, and the alignment of its partners. The weakest link defines the outcome. Building resilience therefore depends on coordination and collaboration, both of which are inherently difficult to maintain over time.

In response, many organizations are narrowing their focus. There is a renewed emphasis on core activities, accompanied by a willingness to reassess or exit areas that no longer align with strategic priorities. What once appeared attractive can quickly lose its appeal under new conditions. This process of prioritization and pruning reflects a more disciplined approach to capital and attention. Yet it also introduces its own tension. As sectoral correlations increase, concentrating on the core does not necessarily reduce exposure; it may simply change its form.

Perhaps less visible but a significant component of this system is small businesses. During fragile economic conditions, their vulnerabilities become more pronounced. Financial buffers may be limited. Given their critical role within supply chains, any weaknesses or failures may create a hidden layer of systemic vulnerability that larger institutions may underestimate. These secondary risks can propagate and contribute to a material level of systemic risk.

The challenge now is to prepare and ensure that organizations can operate where shocks can cascade unpredictably. It requires a shift in thinking beyond just a few futures. There are now greater organizational demands for risk to become more integrated and central to setting and executing strategy.

Contributed by Michelle Tuveson, Danny Ralph, and Trevor Maynard