Why are most Boards are failing at their number one job?
Many Boards spend two hours reviewing last quarter’s financials.
Fifteen minutes are allocated to “strategic discussion.”
This is not Strategy. This is planning theatre.
And according to McKinsey’s research, it’s happening everywhere. While 100% of corporations have formal strategic planning processes, fewer than 25% report these processes as key to making their most important decisions.
Let that sink in for a moment.
The Inconvenient Truth
30% of directors at large U.S. corporations admit insufficient time is spent discussing Strategy in Board meetings.
More than 35% rate their Boards unfavorably on reviewing progress toward strategic goals and identifying future threats.
Business disrupters like AI, digitization, and cybersecurity? Often missing from Board agendas entirely.
Translation: Most Boards are failing at their number one job.
The Strategy – Risk Fallacy
Strategy and risk are not separate responsibilities. They are two sides of the same coin. Every strategic choice introduces or changes risk. Every risk you ignore becomes a strategic vulnerability.
Yet, most Boards treat them as completely different agenda items, handled by different committees who rarely talk to each other.
This is organizational malpractice.
The 2 – 5X Performance Gap
Research shows firms with effective strategies are 2 – 5 times more productive and profitable than their peers. Strategy is literally the single most important factor in organizational performance.
So why aren’t more Boards getting it right?
The Seven Questions That Expose Bad Strategy
Test your board’s strategic work against these criteria:
- Does it guide and constrain future management actions?
- Will it cause dramatic progress within 3 – 5 years?
- Does it actually bind this and future Boards?
- Does it dictate most strategic spending?
- Does it force management to stop some projects?
- Does it account for organizational – level risks?
- Does it provide crystal-clear direction?
If you answered “no” or “I’m not sure” to most of these, you’re not doing strategy. You’re approving PowerPoints.
What Good Actually Looks Like
Effective Boards approach strategy systematically, Here are some examples:
They Invest Real Time – Minimum four hours per quarter. Off-site. No distractions. Strategy first on the agenda when everyone’s fresh, not exhausted from operations reviews.
They Separate Information from Discussion – Management presentations happen before the strategy session, not during it. The Board owns the strategic dialogue.
They Use Proper Frameworks – PESTEL for external forces. SWOT for competitive position. Porter’s Five Forces for industry dynamics. VRIO for sustainable advantages. Gap Analysis for execution planning. These aren’t academic exercises. They’re diagnostic tools that reveal the truth.
They Watch for Blind Spots – Three fatal mistakes that kill strategies:
- Misjudging industry boundaries; viewing your market too narrowly while disruption reshapes everything
- Underestimating competitors; arrogance about market share while nimble players eat your lunch
- Missing emerging trends; failing to scan the horizon until threats are already inside your gates
The Risk Reality Check
Now let’s talk about the other side of the coin.
Today’s risk landscape looks nothing like it did five years ago:
- AI disruption happening faster than anyone predicted
- Climate impacts accelerating beyond worst-case scenarios
- Geopolitical instability redrawing the global order
- Cyber threats evolving daily
- Supply chains more fragile than anyone imagined
- Social divisions creating operational challenges
Yet many Boards still rely on risk registers created three years ago.
The Five Step Risk Process That Works
Effective risk management follows a clear cycle:
Step 1: Identify
Look everywhere: financials, operations, strategy docs, legal records, HR data, external environment. Use multiple sources and perspectives.
Step 2: Analyze
Risk Severity = Likelihood × Impact. But also consider velocity (how fast could this hit?) and connectivity (what else could it trigger?).
Step 3: Respond
Four options: Avoid it, Reduce it, Retain it, or Transfer it. Choose based on cost-benefit and risk appetite. Remember: Residual Risk = Inherent Risk.
Step 4: Monitor
Nothing stays static. Continuous monitoring isn’t optional, it’s essential. What was low probability yesterday might be high probability today.
Step 5: Measure
KRIs (Key Risk Indicators) are as important as KPIs. Both leading and lagging indicators. Updated frequently. Visible to decision – makers.
The Black Swan Problem
Remember when we said these events were impossible?
- 9/11 terrorist attacks
- 2008 global financial crisis
- COVID-19 pandemic
- FTX collapse wiping out billions overnight
Nassim Taleb calls these Black Swans: events that are surprises, have major impacts, but get rationalized in hindsight.
The lesson isn’t to predict the unpredictable. It’s to build resilience for scenarios you think are “impossible.”
Because impossible just means we haven’t seen it yet.
The Lac-Mégantic Warning
July 2013. Lac-Mégantic, Quebec. A runaway train carrying crude oil derailed and exploded. 47 people died. Downtown destroyed.
The risk factors were all visible:
- Cost – cutting without risk analysis
- Single crew member operating massive trains
- Degraded track infrastructure
- Known air brake deficiencies
- No comprehensive risk reviews
- Regulatory oversight failures
- Outdated tanker cars carrying explosives
The critical lesson: Risks compound. They don’t occur in isolation.
This is why siloed risk management fails. This is why you need Enterprise Risk Management.
Why ERM Isn’t Bureaucracy
Enterprise Risk Management gets a bad reputation. People think it’s:
- Bureaucratic overhead
- Paralyzing caution
- Initiative killer
- Compliance theater
That’s bad ERM.
Good ERM:
✓ Enables prudent risk-taking
✓ Clarifies decision rights
✓ Builds organizational resilience
✓ Supports strategic execution
✓ Creates competitive advantage
The COSO Framework provides the structure: Internal Environment → Objective Setting → Event Identification → Risk Assessment → Risk Response → Control Activities → Information & Communication → Monitoring.
Skip a component and the whole system weakens.
The Questions Your Board Must Answer
At every Board meeting, ask:
- Is our Board truly managing risk or just reviewing reports?
- Can we actually rely on our control functions?
- Does our culture reward prudent risk management?
- Are we assessing significant risks continuously?
- Are we scanning for emerging threats?
- Do our policies actually drive behavior?
- Are incentives aligned with risk management?
- Do we have resources for effective responses?
If you can’t answer confidently, you have governance gaps.
Your 90 Day Action Plan
Days 1-30: Assessment
- Audit how your Board spends time in meetings
- Review your last three “strategy” discussions; were they actually strategic?
- Examine your risk register; when was it last meaningfully updated?
- Survey directors on strategic and risk oversight effectiveness
Days 31-60: Planning
- Schedule quarterly 4 hour off-site strategy sessions
- Engage a professional facilitator
- Implement the seven phase strategy process
- Launch the five step risk management cycle
- Define clear risk appetite and tolerance levels
Days 61-90: Execution
- Conduct first off-site strategy session
- Update risk register with emerging threats
- Create integrated strategy / risk dashboard
- Establish quarterly review cadence
- Communicate new approach to management and stakeholders
The Stakes
Organizations with effective strategies are 2 – 5X more productive than peers.
Organizations with mature ERM outperform during crises and disruptions.
The combination of strong strategy and integrated risk management creates sustainable competitive advantage.
The absence of both creates organizational vulnerability.
Make a Choice
You can continue spending Board meetings reviewing backwards looking reports and calling it strategy.
You can keep treating strategy and risk as separate domains managed by committees that rarely coordinate.
You can hope that the next disruption, crisis, or Black Swan event won’t hit your organization.
Or you can fix it.
The research is clear. The frameworks exist. The best practices are proven.
What’s missing isn’t knowledge. It’s will.
As Warren Buffett reminds us: “Everyone is a Risk Manager.”
The question is whether you’re a good one.
– – –
What’s the biggest gap between your Board’s strategy work and what it should be? Drop your honest assessment in the comments. I read and respond to every one.
If this resonated, share it with a fellow director who needs to see it. Tag them in the comments.