McKinsey Classics | October 2024

A board’s guide to better risk management

In 2017, McKinsey surveyed more than a thousand board directors to gauge how their boards were prioritizing risk management. The results? Most of them weren’t. In the seven years since then, the global risk landscape has become only more complex and volatile, from economic disruptions to geopolitical uncertainty to the rapid proliferation of AI and generative AI. If your board isn’t prioritizing a holistic, organization-wide approach to risk management, it should be.

To get serious about proactive risk management, boards can focus on three crucial actions. First, develop an effective risk operating model to identify potential risks and establish a baseline risk appetite. Second, manage that model through an effective governance structure that fosters a shared risk culture, with leaders acting as role models. Finally, make sure the board has a detailed, best-in-class response plan for corporate crises at the ready. Following a few fundamental principles can prepare boards, and the organizations that they serve, to manage a wide range of threats.

Business models today are constantly evolving in the face of rapid, volatile change, and risk functions need to evolve as well. To help make sure your company is prepared on its path to risk resilience, read Thomas Poppensieker and coauthors’ 2018 classic “Value and resilience through better risk management.”

— Drew Holzfeind, editor, Chicago