Risks are a primary board responsibility, and a strong risk philosophy will help boards to be a secure base in this area. The board provides risk backstops for management and also drives the risk appetite of the organisation. In addition, the board makes major choices regarding mergers and acquisitions, culture, and strategy that drive the fundamental risks of the business. Thus, a well-anchored risk philosophy is important, especially as the world becomes more chaotic and the risks ever more challenging.

As the value of goodwill features more prominently on companies’ balance sheets, their responsibilities for managing risk – and especially reputational risk – increase greatly. Not handling this issue properly can have substantial implications, as the case of US theme park chain SeaWorld illustrates.

All boards should keep the following six principles in mind regarding risks, whether these concern people, markets, operations, safety, demand, or other parts of the organisation's activities.

Risks are everywhere! Many business leaders think about risk too narrowly. True business risks go far beyond the technical risks that risk departments or chief risk officers focus on. They can be external, related to the industry, competitors, customers, the environment, and the economy, or internal, stemming from operations, leadership and decision skills, and personal ethics. Risks can be hard and quantifiable or soft and qualitative. They may be well defined or ambiguous. Risks are connected to strategy, and to the levels of complacency, discipline, and creativity in the organisation. Boards must therefore develop a specific view of risks, and not rely solely on a management risk report.

Risk techniques will fail. Indeed, they are bound to do so, because if we knew exactly what the risks were, they would not be risks anymore. The goal of risk techniques is thus not to determine precise risk results, but to understand the complexity and sophistication of current risks in order to respond intelligently. This is why ‘black box’ risk models don't help boards in their risk work.

For every risk there is an opportunity. Success is about navigating risks, whether the goal is to make money, treat customers and employees well, or cater to shareholders or governments. A challenging wind can in fact carry a well-managed organisation further, while blowing others off course.

The deepest risk is the one within us. Ultimately, it is the ability to decide and steer a business in the right direction that matters the most. Each individual has their own risk responsibility, and every board member, manager, and employee owns his or her own risk decisions. This responsibility requires awareness, which in turn drives true success. The biggest risk is not external; it is our own ability to decide in the face of all the other risks.

Risk is positive. What takes you down can take you up. Life is risk. Business is risk. Without risk, there is no movement, opportunity, challenge, or growth. Risk is what makes us choose the right path and the right decision. It is what sends us to the acme of success. The only thing more beautiful than risk itself may be the strength and ability to avoid the risks we choose to avoid, to take the risks we choose to take, and the wisdom to know the difference.

There is no single best way to measure risk. Risk techniques do have value. Sensitivity analyses, stress tests, volatilities, scenarios and Monte Carlo simulations all look for simple solutions to risks. But any model has deficiencies – from simple (extreme versus moderate risks) to complex (linkages between risks) – that make it incomplete and thus wrong. There is no complete and perfect mathematical measure of risks. These risk measurement tools can provide guidance and may support executive thinking. But they can fail too, so boards should remain somewhat sceptical.

Because risk measures do not always work, boards should have several frameworks to think about risk. Preparing for risks is more useful to a board than measuring them (or believing it has done so). And developing the right risk culture, with a balance of appetite and aversion, is most useful of all. Risk awareness should be ingrained in the behaviour of everyone within the organisation, with as great a sense of ownership as possible.

With these principles in mind, the next chapter offers practical ways for board members to think about risk.