But here is the key question. If the leaders of the organization are not persuaded that risk management is adding value by enabling success, and believe that there are better ways to invest scarce resources, why should we surprised that the risk management activity is under–funded?
A risk register makes you feel good. It makes you feel you have accomplished something, a list of risks that might cause harm to the organization. It makes the executive team and the board feel that they can check the box: “do you have a risk management program? Yes.” But, does that risk register help people formulate and then execute the right strategies for the organization to deliver optimal value?