The chair turns to the CEO and asks if there are any risks in the business. What happens next?
In most boards, in most companies, the answer is a story. The CEO talks for two minutes. He mentions a couple of customer accounts, a hiring pinch, something about the product roadmap. The board nods. Everyone moves on.
That answer is worth nothing.
The CEO almost certainly does not know where the actual risks sit. He is operating from feel, from the loudest noise in his inbox last week, from what got escalated to him at lunch on Tuesday. If you asked him whether the talent pipeline in his engineering org is in good shape, he could probably tell you. If you asked him whether the combination of slow time to productivity in engineering, a sales leader on garden leave, and an expiring partner contract added up to a single zone going amber, he would have no idea. Because no one has shown him the map.
Some companies do better. Some have a risk register. A spreadsheet of named risks, owners, mitigations, and a column of red, amber, and green dots. Familiar. Defensible. Almost certainly what your company secretary just printed for the meeting pack.
A register is better than gut.
A register is still not enough.
The reason is structural. A register is a list. Lists tell you about individual items. The risks that actually hurt a business are rarely individual items. They are combinations. Three minor issues clustered inside one part of the operating model, taken together, are a different conversation from three minor issues spread evenly across the business. A list cannot tell you which of those situations you are in. A map can.
When I was COO at Lumeon, every component of how we ran the company sat on a one-page operating model. Customer lifecycle on one side. Product lifecycle in the middle. Supporting functions, finance, legal, IT, HR, risk, on the other. Each box had a named owner and a codified process. Underneath each box sat a spreadsheet of what could go wrong, the mitigations in place, and a score.
The colour on the picture was not a vibe. It was the rollup of the scoring underneath.
The discipline is what makes the colour real. Every component reviewed quarterly. Every risk scored on impact and likelihood. Every mitigation logged. The owner is a person, not a function. When a box moves from green to amber, somebody has to explain why. When a box stays amber for two quarters running, the work to fix it has to be on the plan.
The thing a list cannot do, and a map can, is show clustering.
A single amber box is a process problem. Two amber boxes inside one operating area is a leadership problem.
The map shows that without anyone having to say it. When two of the four boxes inside customer lifecycle are amber, the conversation is not “how do we fix support escalation and how do we fix billing.” The conversation is who owns customer lifecycle as a function, and are they doing the job. The board can see that pattern in five seconds. Nobody has to call the leader out by name. The picture does the work.
In our case at Lumeon, when boxes went amber they tended to be isolated. Customer escalation management was amber for a stretch. Not because customers were unhappy at scale, but because the way escalations got triaged and routed to engineering had room to be tightened. Process and ownership, not headcount. Three months later the box was green. Talent management was amber at another point. Hiring and firing flow. Mitigation followed. Each was its own box. The map confirmed they were not part of a cluster, which is its own valuable answer.
The shape is regulated-industry-shaped, not healthcare-shaped. Financial services, life sciences, anywhere with a regulator who wants quantitative answers and a board that wants comfort. The boxes change. The map does not.
I once went through this with the CEO of a regulated financial services business who was struggling to scale. He had no register. He had been answering board questions about risk the way most CEOs do, from gut. We never got past the risk-map slide. When we mapped his operating areas and overlaid the scoring, two of his ambers clustered inside one function. He saw it the moment we looked. So would his board, the next time they asked the question. The hard conversation for him was not the conversation about the function. It was the conversation about who ran it.
A register tells you what could go wrong. A map tells you whether the people running the business are running it.
Pick which question you want your board to be able to answer.
For a worked example of the kind of map this post describes, explore the interactive target operating model and switch on the Risk overlay.