Important Risk Meetings

Why It Matters

Embedding risk analysis in routine decisions ensures that CEOs, CROs, and boards mitigate exposure before it materialises, strengthening overall corporate resilience.

Key Takeaways

• Decision meetings inherently contain risk assessments.
• Risk officers should embed in procurement, hiring, security meetings.
• Ignoring risk in everyday decisions creates blind spots.
• Boards must ensure risk data informs all choices.
• Effective risk management needs reliable information at decisions.

Pulse Analysis

Risk management has traditionally been siloed in quarterly reviews and static risk registers, but modern enterprises are discovering that true risk mitigation occurs at the moment a decision is made. By reframing every decision forum—whether a procurement negotiation, a hiring panel, or a strategic brief—as a risk meeting, organizations shift from reactive reporting to proactive governance. This approach aligns risk considerations with business objectives, ensuring that potential downsides are evaluated alongside opportunities in real time.

In practice, integrating risk expertise into procurement meetings helps assess vendor reliability, supply‑chain continuity, and cost implications before contracts are signed. Hiring discussions benefit from evaluating candidate fit against operational risk, cultural alignment, and succession planning. Even high‑stakes national‑security briefings illustrate how risk officers can provide calibrated intelligence, scenario analysis, and mitigation pathways. Chief Risk Officers (CROs) and Chief Audit Executives (CAEs) can act as facilitators, supplying validated data, risk models, and decision‑support tools that empower managers to make informed choices without slowing the process.

For CEOs and boards, the imperative is clear: embed risk ownership across all decision‑making layers and demand evidence‑based risk inputs at every meeting agenda. This governance shift not only reduces surprise losses but also enhances stakeholder confidence and regulatory compliance. Companies that institutionalise risk‑informed decision making gain a competitive edge, turning uncertainty into a strategic advantage.

Important risk meetings

Norman Marks · January 19, 2026

The most important risk meetings are not the ones where the risk officer asks the operating manager what their risks are. They are also not the ones where people gather to review and discuss a list of top risks.

No.

It’s meetings like these:

• Procurement meeting – The procurement manager meets with the manufacturing, sales, and finance managers to discuss who they should select as a vendor for critical materials. They talk about the risks (positive and negative) of selecting each vendor: which is more likely to consistently deliver materials on time, which is more reliable in terms of quality, and which gives the best chance for profitable operations.

• Hiring meeting – The hiring manager meets with the HR representative and everyone who interviewed the top three candidates for a key position. They discuss and debate which candidate is more likely to have the necessary skills and experience, which would be the better team player, and which has potential for advancement.

• National security meeting – The President of the United States presides over a meeting in the White House Situation Room. The Vice President and the Secretaries of State and Defense are there, together with the heads of each of the branches of the military and the CIA. They have been told that a nuclear device is missing and is suspected to be in the hands of a known terrorist organization. They talk about the likelihood of it being with this or that group, in this or the other location – and what they can do about it.

In other words, every meeting to make a decision is a risk meeting.

We should ask:

1. Are decision‑makers effectively considering, with reliable information, all the relevant risks?

2. Do they need the risk officer to be present, or at least be involved in ensuring they have the information they need?

These meetings are where risk is not only taken but managed.

If all you do is occasionally review a list of risks, you are ignoring the fact that risks are being taken (and managed) every time a decision is made (or not made).

• What is your CRO doing about that?

• What is your CAE doing about that?

• What, for that matter, are the CEO and the board doing about that?

I welcome your thoughts.