Monday, 28 September 2026

Risk is defined as the effect of uncertainty on objectives in the ISO 31000, the international standard for risk management. Organisations across sectors and borders have adopted this elegant definition. Unfortunately, in many organisations, the machinery built to act on it has quietly become the opposite of what it intended.

The symptom is familiar to anyone who has served on an audit and risk committee. The risk register keeps growing, every review adds a few more items, while nil (or very few) are removed. Before long, the document runs to several hundred entries, each neatly fitted with a likelihood rating, a consequence rating and an owner. It looks thorough, it feels like control, but when something serious goes wrong, the cause is rarely on the list.

When the register becomes the risk

Dr Mike Rollo, a risk executive with more than four decades in infrastructure and a former Chief Risk Officer, puts the problem plainly. “You cannot manage more than 30 or 40 sources of risk,” he argues, and a register carrying three hundred items is simply unworkable. His term for it is exact. “That is list management,” not risk management.

The distinction matters because the two activities feel identical from the inside. Adding an item to a register produces a small hit of reassurance. The risk has been captured, rated and assigned, so it must now be under control. Multiply that reassurance across hundreds of entries and an organisation can convince itself it has covered the field, when in reality it has built an inventory that no human being can keep in their head, let alone act on.

Researchers such as Dr. Rollo who study why large projects fail see the same pattern from a different angle. Major projects consistently exceed their budgets, and a recurring cause is not bad luck but inadequate risk prediction, with no allowance set aside for the genuinely unpredictable and with managers who often lack project-specific experience. The failures trace back to conditions a register of discrete events was never built to capture.

The risks that never make the list

If the damaging events are rarely on the register, where do they come from? The answer is that many registers capture the wrong category of thing. They are filled with minutiae, discrete events that may or may not happen, while the genuine sources of risk go unrecorded.

Those sources tend to live in two places. The first is the internal environment. What is the quality of leadership on this program? Is the organisational structure fit for the task? Do the people delivering it have the experience the work demands, and how well are they trained and supported? The ISO 31000, as the international standard, is explicit that risk management should be shaped by an organisation’s internal and external context, yet in practice registers rarely capture either. These are not line items, so they seldom appear, even though they shape the likelihood of failure more than any single external event.

The second is the external environment. Have we done anything like this before? How much time do we have? What economic conditions could move costs, availability or demand while the work is underway? A program can carry a pristine register and still be undone by a shift in one of these fundamentals, precisely because the register was watching the wrong horizon.

The most consequential exposures are also increasingly interconnected. The 21st edition of World Economic Forum’s Global Risks Report describes a world in which risks are growing in scale, interconnection and velocity, with the most damaging exposures cutting across domains rather than sitting in neat categories. A list of discrete events is structurally unable to see risks that behave as a system. 

The paradox of control

There is a deeper reason registers keep swelling, and it is behavioural rather than technical. When a project starts to wobble, the instinctive response is to tighten the grip: add more items, demand more reporting, insist on more approvals. Each addition feels like a step towards control.

Rollo describes this as the paradox of control, the observation that the harder you try to control something, the less control you actually have. Piling items onto a register is a mechanistic response to a problem that is usually organic in nature. It consumes the attention of the very people who should be exercising judgement, and it buries the handful of risks that genuinely warrant senior focus beneath a mass of low-value entries.

The alternative is counterintuitive but consistent with how experienced practitioners already work. Narrowing a register to a smaller number of well understood strategic risks is not a retreat from rigour, it is the condition for rigour. Thirty risks that leaders can name, discuss and challenge will always be managed better than three hundred that no one can carry.

Looking over the horizon

A shorter register frees capacity for the work that actually reduces exposure, which is thinking ahead. If everyone in an organisation is focused on the immediate, nobody is looking over the horizon, and the surprises that arrive from over the horizon are the ones that hurt.

Scenario thinking is the practical antidote. An organisation cannot know whether another pandemic, a sharp move in commodity prices or a regional conflict will occur. However, once leaders have genuinely thought through what each scenario would mean for their objectives, that possibility is no longer pure uncertainty. It has been examined, and examination is the first form of treatment. Good organisations rehearse these questions deliberately rather than waiting for events to ask them.

This is not a fringe practice. The Global Risks Report is itself a structured horizon scanning exercise, assessing risks across immediate, medium and long term timeframes rather than reacting to whatever happens to be closest. The discipline is the same at any scale. Look forward deliberately, and treat emerging risk as a standing item rather than a surprise.

From list management to risk management

The shift organisation need is not a new framework. The frameworks are sound and the standard is clear. What is required is a change in how they are used. Here are four moves that can make the difference:

• Cut the register to the risks that matter: Aim for a set that leaders can hold in mind and genuinely govern, and be willing to retire items that are really day-to-day issues rather than strategic risks.
• Put the sources of risk on the register, not only the events: Leadership, capability, structure, culture, time and economic conditions belong there, because they drive the events everyone else is trying to predict.
• Test the register through scenarios: Ask what would have to be true for a strategic risk to materialise, and whether the organisation would cope, rather than assuming a rating captures the answer.
• Review whether controls actually work: ISO 31000 treats monitoring and review as core to the process, so a control that has never been tested should be regarded as an assumption rather than a safeguard.

None of this asks practitioners to abandon the register. If it is being used well, it remains a valuable tool. The point is that a register is a record of thinking, not a substitute for it. The organisations that manage risk well are not the ones with the longest lists, they are the ones that have kept their lists short enough to think.

About the Author

Paul Vorbach is the Managing Director of AcademyGlobal, a Sydney-based capability development firm established in 2004 and the CIPS Centre of Excellence for ANZ. Since 2005, Paul has trained contract management, procurement and supply chain professionals across over twenty centuries in five continents. He is Vice President of the Institute of Strategic Risk Management (ISRM) ANZ, Treasurer of the Society for Risk Analysis (SRA) ANZ, and Adjunct Faculty at the Australian Graduate School of Management (AGSM) at the University of New South Wales.

AcademyGlobal partners with public sector, private sector, and not-for-profit organisations to build the capability that underpins sustainable delivery performance, and is the Chartered Institute of Procurement and Supply (CIPS) Centre of Excellence for Australia, New Zealand and Asia.