After my last article, several colleagues responded: “ERM isn’t dead – it just needs to evolve.”

I agree but would go further – the real question is not “Is ERM dead?” but: can risk management become the intelligence engine that enables better decisions under sustained pressure?

The answer is yes – when risk evolves into Strategic Resilience Management. At its core is a simple shift: risk becomes organisational intelligence.

ERM as a discipline remains essential. But ERM as enterprise list management – long registers, annual scoring, static heatmaps – is no longer sufficient for today’s environment. That model worked when disruption was episodic. It does not serve a world of sustained pressure.[1]

The issue isn’t competence. It’s context.

The UK operating environment is defined by continuous stress on systems, decisions and leadership judgment. With growing emphasis on systemic resilience and whole-of-society interdependence, risk can no longer sit adjacent to strategy.[2]

It has to inform it.

Risk as the intelligence engine.

Boards are not asking for more risks. They are asking:[3]

• Where are we strategically fragile?
• What could realistically disrupt delivery?
• Are we investing in initiatives that remain viable under pressure?
• How robust is decision quality if conditions deteriorate?

Traditional ERM struggles to answer these because it starts with risks as discrete items.

Strategic Resilience Management starts with essential outcomes. What must continue – regardless of cause – to protect performance, reputation and trust?

From there, risk intelligence becomes systemic rather than categorical. Practically, this means:

• Mapping interdependencies across financial, workforce, infrastructure, social and environmental capitals
• Identifying cascade pathways and amplification risks
• Testing severe-but-plausible scenarios
• Defining impact thresholds (how much disruption is intolerable, irrespective of driver)
• Establishing early-warning indicators tied to those thresholds

This shifts the executive conversation from:

“How likely is this?”

to

“If this is plausible, how exposed are we — and what does that mean for our strategy?”

That is a far more useful Board discussion.

From insight to capital allocation

This becomes tangible through strategy integration.

Under sustained pressure – and during continuous change – the question is not whether disruption will occur, but whether investments remain viable when it does.

In practice, that means:

• Stress-testing major strategic initiatives
• Integrating resilience criteria into M&A and transformation decisions
• Aligning risk appetite with performance tolerance
• Prioritising investments that strengthen multiple capabilities
• Designing modularity, substitution and optionality into critical services

This is where risk shifts from reporting to influence.

Boards are less interested in heatmaps and more interested in: “Where are we strategically fragile, and what are we doing about it?”

A credible risk intelligence capability should be able to answer that clearly.

Culture: The missing variable.

Sustained pressure erodes decision quality.

Cognitive overload increases.
Escalation narrows.
Challenge weakens.
Short-term trade-offs dominate.

Organisations rarely fail because of a single shock. They fail because leadership judgment degrades under continuous strain.[4]

Culture, therefore, is not a soft add-on to resilience – it is part of the control environment.

Practically, that means:

• Exercising leadership decision-making under pressure, not just operational playbooks
• Embedding ownership of essential outcomes across business units
• Using risk–resilience dashboards actively, not presentationally
• Encouraging open challenge and early escalation
• Monitoring workforce fatigue and behavioural indicators as strategic risk drivers

Resilience capability is not redundancy and recovery plans alone. It is sustained clarity, accountability and adaptability under volatility.

Without that, even well-designed controls weaken.

Governance:-integration, not proliferation.

Most organisations already have risk, resilience, security, continuity and strategy teams. The issue is not absence — it is fragmentation.

Strategic Resilience Management does not require wholesale restructuring. It requires coordinated governance.

That might mean:

• An integrated Strategic Resilience function
• A federated model with shared KPIs and Board dashboards
• Elevating ERM into a strategic performance stability advisor

The structure matters less than the integration.

Risk insight must inform resilience investment.
Resilience capability must inform strategy.
Strategy must reflect exposure reality.

Otherwise, we remain in parallel programmes.

What this means – for boards and risk leaders.

For Boards, the shift is from reviewing risks to testing resilience.

That means asking:

• Where are we strategically fragile?
• What objectives are exposed?
• What outcomes are intolerable to lose?
• Are major investments viable under sustained disruption?
• How confident are we in decision quality under pressure?

Strategic Resilience Management links risk intelligence directly to capital allocation, strategy execution and performance thresholds. It strengthens oversight credibility and increases confidence that the organisation can meet objectives while absorbing shocks and adapting – not just report exposure.

For practitioners, this is an opportunity.

We can move from curating registers to shaping executive decisions.

In practice, that means:

• Anchoring discussions around essential outcomes
• Replacing likelihood debates with plausibility and tolerance thinking
• Stress-testing strategy, not just operations
• Mapping interdependencies and cascade pathways
• Embedding resilience indicators alongside traditional KRIs
• Exercising leadership judgement under sustained pressure

These shifts are already being expected – implicitly and explicitly – by Boards and regulators who want demonstrable resilience, not procedural compliance.

The environment is unlikely to stabilise and change is unlikely to stop.

The organisations that outperform will not be those with the longest risk registers, but those with the clearest intelligence, integrated governance and strongest decision culture under pressure.

Risk is not dead.

But to avoid becoming irrelevant it must innovate and rebrand from a reporting framework into the intelligence engine that protects performance, enables strategy and sustains trust.

[1] McKinsey & Company. Value and resilience through better risk management.

[2] UK Government (2022), UK Government Resilience Framework

[3] EY (2023). Global Board Risk Survey.

[4] McKinsey & Company. Strengthening institutional risk and integrity culture