Are Boards Too Risk-Averse to Create Value?

In a world defined by disruption and uncertainty, boards need to look beyond the risks of acting and consider the risks of standing still instead.

Boards today are being asked to be bold and cautious at the same time, and the two instincts are increasingly hard to reconcile. Geopolitical tensions are reshaping supply chains. Artificial intelligence is transforming business models and competitive dynamics. New technologies and market entrants can disrupt established industries at unprecedented speed. At the same time, directors face growing expectations around governance, accountability, and regulatory compliance.

Against this backdrop, it's understandable that boards may hesitate before making bold decisions. The fear of reputational damage, legal exposure, or making the wrong call can weigh heavily on decision-making.

But there is another risk that deserves equal attention: the risk of doing nothing.

This was one of the central topics explored during a panel discussion at the SID Directors Conference 2026, where Keith Tan, Partner at RSM Singapore, joined Jeffrey Paine, Founding Partner of Golden Gate Ventures, and Tan Yen Yen, Independent Director, Jardine Cycle and Carriage, to discuss whether boards are becoming too risk-averse to create value.

The discussion pointed to a deeper question: are boards still thinking about risk primarily as something to protect the organisation from, when they should also be thinking about how risk can inform where the organisation goes next?

The risk of standing still

A company can be well managed, financially sound, and operating successfully, yet still find its position challenged when a new technology, competitor, or market development changes the rules.

Boards can't be expected to predict every disruption. But they can challenge whether the organisation's assumptions about the future remain valid.

This means considering two sides of every major decision: what happens if we act, and what happens if we don't?

The second question is often harder to answer because the consequences of inaction are less visible. A failed investment can be measured. A market opportunity never pursued, a technology never adopted, or a strategic shift made too late may only become obvious in hindsight.

Jeffrey Paine's perspective from venture capital illustrates the importance of making risk more deliberate. With investment decisions often made under significant uncertainty, the focus isn't on eliminating risk, but on assessing whether the organisation can survive if a decision goes wrong, whether the decision can be reversed, and whether the potential upside is meaningful.

For boards, this provides a useful framework for distinguishing calculated risk-taking from risk-taking for its own sake.

Resilience isn't the same as being disruption-proof

The same tension applies to geopolitical and supply-chain risks.

As Yen Yen highlighted during the panel, geopolitical developments should no longer be viewed simply as temporary risks. They are strategic issues that require conscious decisions around diversification, redundancy, and long-term positioning.

But there's a trade-off.

While building additional capacity, diversifying suppliers, or creating redundancy can strengthen resilience, these measures can also carry costs. An organisation that over-engineers itself for every possible disruption may ultimately become less competitive.

The objective, therefore, shouldn't be to become disruption-proof, but to ensure that the organisation still has options when disruption occurs.

Resilience is ultimately a strategic choice, not simply a risk management exercise.

Boards need to determine where resilience is critical, what trade-offs they're willing to accept, and how much flexibility the business needs to respond to different scenarios.

Ask what isn't on the risk register

Traditional governance is generally effective at monitoring known risks. Risk registers, dashboards, and key performance indicators give boards visibility over issues that have already been identified.

But some of the risks that ultimately have the greatest impact may begin as weak signals.

Yen Yen also highlighted the importance of looking beyond the risks already presented to the board and challenging what may be missing. This means asking what sits outside the existing risk register, including emerging risks, blind spots, and assumptions that may not yet have been formally identified.

This is where proactive governance becomes important.

The answer isn't necessarily to demand more dashboards or more information, as this doesn't automatically lead to better decisions. If boards are asking the wrong questions, they may simply end up with more precise information about the wrong risks.

Instead, boards need to improve the quality and timing of the conversation, challenging assumptions and considering potential risks before they become visible through conventional reporting.

Risk appetite should enable action

This also raises a fundamental question about risk appetite.

An organisation can have a sophisticated risk framework and still struggle to make decisions confidently if management and the board have different interpretations of what constitutes an acceptable risk.

Keith drew on his enterprise risk management experience, noting that risk assessments can sometimes appear entirely 'green' based on management's assessment. The important question isn't simply whether a risk has been rated green, amber, or red, but whether the board and management share a common understanding of what that assessment means for the decisions the business is prepared to make.

A meaningful risk appetite should therefore do more than define limits. It should help management understand where it has room to act, while giving the board a basis for constructive challenge when those boundaries are tested.

Good governance doesn't mean more governance

There's another danger when uncertainty increases: becoming overly defensive.

More approvals, additional controls, and greater escalation to the board may appear to strengthen governance. But they can also slow decision-making and leave management with less room to exercise judgement.

Yen Yen highlighted the importance of giving management sufficient space to act while maintaining clear accountability. The board's role isn't to make every decision, but to establish appropriate boundaries, align on risk appetite, and hold management accountable for the decisions it makes.

The same principle applies to the board agenda itself.

Routine oversight and reporting can consume valuable time, leaving limited room for the conversations that could shape the organisation's future.

Boards therefore need to deliberately create space to consider questions such as:

• Where do we want this organisation to be five or ten years from now?
• What technologies could reshape the business?
• Which assumptions may no longer hold?
• What opportunities are competitors pursuing that we aren't?
• Most importantly, what might we regret not doing?

From protecting value to creating value

The question of risk ultimately comes back to the board's purpose.

Boards don't need to become reckless to become more courageous. But they may need to rethink what effective risk governance looks like.

The objective isn't to remove uncertainty. It's to help the organisation make better decisions despite it.

That means looking beyond known risks, challenging assumptions, considering scenarios, and understanding the trade-offs between resilience, competitiveness, and growth.

It also means recognising that inaction is itself a risk.

Ultimately, effective enterprise risk management shouldn't simply tell the board what could go wrong. It should help directors understand what's at stake, what options exist, and where the organisation can take calculated risks to create future value.

Because in an uncertain world, protecting what you have is only one part of the board's responsibility.

The other is having the courage, and the insight, to create what comes next.

How we can help

RSM Singapore helps organisations strengthen their enterprise risk management capabilities to support better-informed strategic decision-making in an increasingly complex environment.

Our approach can help organisations assess their risk management frameworks, clarify risk appetite, identify emerging and strategic risks, and strengthen risk governance and reporting.

By taking a more forward-looking approach to risk, organisations can be better positioned to navigate uncertainty, preserve strategic options, and pursue opportunities with greater confidence. Speak to us today about strengthening your organisation's approach to enterprise risk management.