The pandemic has resulted in conventional thinking about what can and cannot occur being turned upside down. For years companies have documented the prospect of a pandemic as a “black swan” risk… somewhere in the paper brought out once a year to tick the box of having considered “black swan” risks. But few had given real consideration to what would happen if this actually materialised and, unlike the SARS outbreak, it was global.

The introduction of the requirement for a statement of viability in 2015 did result in some progress, even if initially it was met with a sense of being yet another exercise increasing the volume of paper in the annual report. However, it necessitated thinking through the “severe but plausible” consequences of risks arising, and importantly provided common language with, over time, further guidance on expectations. Yet even this permitted the exclusion of risks considered to be remote in their likelihood of occurrence.

As a governance professional, and a NED, I am fascinated by debates on the lessons we might learn from the pandemic. It is right that we ask whether we should have done more, as Boards and as NEDs, to evaluate significant risks, and whether we have the right structures and forums in place for making this meaningful. It is also appropriate that we respond quickly to ensure that our organisations are resilient as new risks emerge in an increasingly complex environment.

Financial services companies, regulated by the FCA and PRA, are required to have a Risk Committee, with specific rules and requirements related to the documentation, discussion and reporting across a range of risks. There are detailed requirements related to setting appetite and tolerance levels, and over the assurance that should be provided. Beyond these sectors no such requirement exists.

This raises then the question as to whether Boards spend enough time and focus in considering risks and whether companies would be more resilient if there was a requirement for Risk Committees in all instances.

I believe we need to look at this through a more sophisticated lens. Boards do, of course, talk about risks all of the time – risks to customer outcomes, competitor risk, pricing risks and many more areas. Its simply not couched in this language. In part this is because our understanding of risk is generally downside – preventing incidents arising that could damage the organisation. The concern is then that if we spend too much time on risk, we are not being innovative, agile, or responding to commercial opportunity.

Can we turn this around? I have often used the example of a Formula 1 car. The driver has the confidence to go faster because they know the brakes have been tested, in the factory and on the track, so will always work when they are required. Really understanding risks – identifying those we need to mitigate with absolute confidence, those that we cannot control but need to respond to effectively, and those that we must stetch ourselves to take to deliver strategic outcomes – means we can win the race more often.

A Risk Committee might be a means of providing a focal point for discussion of risks, for evaluating the impact of multiple risks emerging together and for the evaluation of operational resilience in response to risks. More important is to ensure governance structures are aligned with the nature of risks and our appetite for taking them. Our risk documentation should facilitate conversation integrated with strategic outcomes and the achievement of commercial goals. And we should not shy away from evaluating the options and priorities should our most significant risks materialise, regardless of the likelihood. We will then have sustainable, resilient and successful outcomes.