Your biggest risk may not be your most important risk.

Directors are used to seeing risks scored and colour-coded. Often with an attempt to quantify all risks, including non-financial ones. It’s a useful way to bring some order to a complicated picture, but it can also give a misleading sense of where leadership attention, and importantly decision making, is a priority. 

A risk only matters because of what it could affect.  

The same risk can have very different implications for different strategic objectives, while several individually relatively modest risks can combine to put one important objective under real pressure. The risk appearing to have the highest score is not necessarily the one that requires the most important leadership decision or intervention. 

Rather than asking, “What are our biggest risks?”, leaders should be asking, “Which objectives are we least confident about achieving, what is driving that, and what decisions or actions would most improve our chances of success?” 

In doing so, we shift the focus from ranking risks to using risk insight to make better decisions about achieving what matters most. 

Where should leadership attention be prioritised? 

A top-ten risk list has obvious appeal. For risk teams, it makes a complicated picture manageable. For directors, it offers a quick view of where attention may be needed. 

The difficulty is that the ranking can take on more meaning than it deserves. It is hard not to assume that the higher ranked risks matter more than others, and require the greatest leadership attention or action. 

However, the same risk can also matter very differently across objectives. A shortage of specialist capability might be manageable for one priority but the critical constraint on another. Three moderate risks, perhaps around capability, technology and third-party dependency, may not look especially alarming individually, but together they could put one strategic objective under serious pressure. 

The reverse can also be true. A highly rated risk may be significant but stable, well understood and within a tolerable level of appetite given the control that the organisation has over its outcome. It still matters, but it may not be where another hour of executive attention, or another pound of investment, will make the greatest difference. 

Risk importance is not absolute. It depends on context. 

The question is not simply how large the risk is. It is what the risk means for what you are trying to achieve, how much confidence you have in delivery, and whether a decision or intervention now could materially improve the odds of achieving the desired outcomes. 

And this matters because executive teams do not manage organisations one risk at a time. They make choices about what to prioritise, where to invest, which trade-offs to accept, what to stop, what to accelerate and where to intervene. Risk information should enable those decisions. A risk ranking can inform those choices, but it might not help leaders see where their attention could make the greatest difference.  

Looking at risk through the lens of objectives gives a different view. It shows where several risks are converging on the same outcome, where a relatively modest risk has disproportionate strategic significance, or where a major risk is already being managed well enough that attention is better directed elsewhere. 

None of this means abandoning risk scores or heat maps. They remain useful tools. It means recognising that they are inputs to decision making, not the answer to the most important question – how to achieve your objectives. 

The point of prioritisation is to focus leadership attention, investment and action where they can make the greatest difference to success. 

Understanding risk isn’t your objective. Achieving your objectives is.