Does strong risk management necessarily lead to improved resilience?

Abstract

Major disruptive events are inevitable, yet organisations continue to experience vulnerabilities despite the widespread adoption of risk management practices. This paper examines whether the expansion of risk management frameworks has led to improved resilience or has introduced unintended complexity that limits effectiveness. In response to significant incidents, standards, regulations, and assessment processes have been developed to strengthen preparedness. These frameworks are often implemented independently, however, resulting in overlapping requirements, fragmented processes, and increased administrative burden. The accumulation of multiple programmes may therefore create inefficiencies in identifying, managing, and reporting emerging risks, while contributing to a false sense of preparedness. The paper analyses how siloed frameworks and function-specific response plans can reduce organisational effectiveness, particularly in complex incidents involving multiple risk domains. It considers how current approaches may fail to provide a coherent, enterprise-wide view of risk and response readiness. The paper argues for a more integrated approach to enterprise risk management, emphasising cross-functional coordination, consolidation of assessment activities, and improved alignment of stakeholders. A more holistic framework enables organisations to prioritise critical risks, improve decision making, and strengthen resilience in an environment of increasing uncertainty and complexity. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.