Why does enterprise risk management still struggle to influence real decisions?
Session 2 · ERQI Global Virtual Risk Summit
The evolution of enterprise risk management
Stefan Hunziker & Linnea Solem
Overview
Enterprise risk management is good at proving its process happened and poor at showing it changed a decision. Stefan Hunziker, an academic, and Linnea Solem, a corporate practitioner, argued that the fix starts with the decision: what the board needs to notice, which assumption could change the choice, and when a threshold forces a conversation. They agreed on the diagnosis and differed in emphasis on the remedy.
Session 2 recording, ERQI Global Virtual Risk Summit 2026
From risk first to decision first
Hunziker argued that risk management's key advances came from outside it: probability theory, decision theory, operations research, and behavioral economics. The field imported many of the tools without always importing the logic. He proposed moving from "risk first" to "decision first," starting with the objective, the alternatives, and the uncertainty that could change the choice. Managers have always managed uncertainty, he said, so the ERM function has to show it helps them do it better. Solem added that the path is not linear, and that early insurance and loss-prevention risks were more tangible to measure than newer ones.
Reporting for attention
A slide showed 98% of respondents saying ERM should play a more strategic role and only 7% reporting full integration into strategy decisions; Solem attributed the figures to a recent COSO update. Hunziker read the gap as an integration problem and described the board risk report as an attention allocation mechanism, citing Herbert Simon's 1971 observation that a wealth of information creates a poverty of attention. In a 20-minute discussion, a top-25 list offers 25 competitors for attention. He recalled a hospital board where the risk report came just before lunch, took about five minutes, and met the legal requirement without informing any decision.
Solem's counterpart from practice: boards ask what has changed and what is wanted from them, and a risk that visibly changed color in the pre-read was the item they opened first. Risk scorecards and dashboards need to show which actions by the company are reducing risk and which factors are increasing it. Risk reports often reflect activities but fail to convey risk impact in business terms.
The matrix, appetite, and narrative
Hunziker called the risk matrix a display format, not an analytical engine, one that hides judgment inside a cell. Ordinal labels cannot be multiplied, apparent consensus on a color masks disagreement about probability and assumptions, colors cannot be aggregated against appetite, and matrices ignore upside. Solem noted that the real work happens before a risk lands in a box.
On appetite, Hunziker said a statement such as "a lower risk appetite for cyber risk" changes nothing until it becomes a decision boundary. A hospital he saw set a minimum EBIT level and required management action if analysis showed EBIT could fall below it. Solem said that "risk statements need to be meaningful, useful and guide choices," providing decision boundaries so that courses of action move from "can we do it" to "should we?" She offered a CEO's "grandma factor": would you sell the product that way to your grandmother? If not, the course of action has not been clearly understood or aligned to risk appetite with tangible thresholds. For executives who will not give up the matrix, Hunziker runs a tornado diagram alongside it for up to three years, then fades the map out.
On qualitative versus quantitative, Hunziker called it the wrong question and asked what serves the decision. Good quantification shows ranges and moves disagreement to probabilities and assumptions, but executives can be impressed by sophisticated models without acting on them. Solem summed up her rule as "the whats, the so whats, and the now whats," and added that nth-party dependencies are often missed.
“The model informs the decision, and it does not make the decision.”
Stefan Hunziker, on qualitative versus quantitative analysis
Key takeaways
1
Decision first
Start with the objective, the alternatives, and the uncertainty that could change the choice. Hunziker's test question: "which assumption would make us change the decision?"
Watch at 7:582
Report for attention
A board risk report allocates scarce attention. It should say what management needs to notice now, what changed, and what decision or action follows.
Watch at 17:423
Make appetite actionable
A threshold with a consequence, such as a minimum EBIT level, does not choose the decision. It tells management when the decision conversation has to happen.
Watch at 33:124
Show ranges with a story
The same distribution prompts different questions from a CFO and a CEO. Both speakers held that numbers need narrative and context to drive action.
Watch at 39:065
Admit what is unknown
Hunziker adds a "what we do not know" section to risk reports and favors scenarios or stress tests where a precise probability model would be false rigor.
Watch at 56:15
