If the biggest risk facing your organisation tomorrow morning materialised at 9:00 a.m., would the board discover it first or the newspapers?
Whenever I ask that question in a governance masterclass, directors shift slightly in their seats. Some smile politely. A few stare at the table. One or two usually laugh because they know exactly where this conversation is going.
Years ago I sat outside the boardroom waiting for my turn as the board meeting went on convinced I was about to deliver the most brilliant risk presentation the directors had ever seen. I had charts, frameworks, matrices, and impressive terminology. In those years, I was a powerpoint turk, would spend lots of hours writing power point presentations so as to impress. I thought a sleek powerpoint was a measure of intelligence. I was wrong. Board members want a conversation.
Two hours later I realised something embarrassing. The board had been discussing operational updates, approving minutes, and debating travel policies, while the real strategic risks facing the company had not even appeared on the agenda.
That was the day I learned a lesson. Most boards mistake activity for governance. Allow me to explain using something very familiar in Uganda. Think of a boda-boda stage.
If you watch closely, every stage has an informal leader. Someone who knows the roads, understands the traffic patterns, and quietly keeps order among the riders. Without that coordination, chaos follows. Riders collide, passengers get frustrated, and the stage loses customers.
The stage works because someone is watching the road before the crash happens. A board must function the same way. Its job is not to admire the motorcycles after the accident. Its job is to see the traffic patterns early and guide the riders before danger appears.
Yet in many organisations, risk management is treated like a compliance exercise buried somewhere inside internal audit or a risk department, for mature organizations. The board receives a report once every quarter, nods politely, and moves to the next agenda item.
That is not governance. That is delegation without stewardship. In October 2023, I was facilitating a retreat for the board of a fast-growing regional telecom company in Masai Mara lodge. The business had expanded rapidly across several markets, revenues were rising, and the management team was confident.
During the discussion, one director raised a hand and asked, a common but powerful question: “What keeps you awake at night as CEO?”
The CEO smiled. “Our growth opportunities.” Another director leaned forward. “That is not what I asked.” The room became thoughtful. After some probing, a deeper picture emerged. The company relied heavily on a single infrastructure supplier located in another country. If that supplier failed, the telecom network could collapse across multiple markets.
The board had never discussed this dependency. One director whispered to me during the break, “We thought risk management was management’s job.” I smiled and replied, “Strategy risk is always the board’s job.”
The pattern is global
If this story sounds local, it is not. Consider a large global telecommunications company that faced a similar challenge years earlier. Their board had spent significant time analysing supply chain concentration risks and insisted management diversify infrastructure providers even though it reduced short-term margins.
At the time some executives complained that the board was being overly cautious. Two years later, a major supplier crisis hit the industry. Competitors struggled to maintain networks. That company continued operating almost seamlessly because the board had forced the tough or difficult conversation early.
The fact is strong boards do not wait for risk reports. They interrogate strategic assumptions. I have observed that many boards drift into one of two extremes.
- Some boards interfere in operational decisions, reviewing procurement contracts and debating minor management issues. They confuse oversight with micromanagement.
- Other boards remain distant from strategy, treating risk as something technical handled by specialists.
Both approaches weaken the organisation. The board’s real role is disciplined strategic stewardship. Directors must ask the challenging questions about where the organisation could fail, where the strategy might break, and where management assumptions may be overly optimistic.
That responsibility cannot be outsourced. During retreats I often introduce a simple exercise called The Strategic Risk Lens.
I ask the board to pause the agenda and answer three questions.
- First, what single event could destroy our strategy faster than management expects?
- Second, which assumption inside our strategy is most fragile?
- Third, which risk are we quietly hoping never happens?
I then ask each director to write their answers privately. The results are always fascinating. One director might highlight technology disruption. Another might identify regulatory change.
A third may point to founder dominance or succession risk. Suddenly the board realises something important. Risk is not a list. Risk is a conversation. Think again about the boda-boda stage.
If riders wait for the accident before adjusting their behaviour, passengers stop coming. The stage collapses. But when someone watches the road patterns early, warns the riders, and adjusts how the stage operates, the business survives.
Boards must behave the same way. Risk management does not begin with the risk department. It begins with the board’s willingness to challenge assumptions.
Before your next board meeting, ask yourself three questions.
- Are we governing the future of this organisation, or merely reviewing reports about the past?
- Which strategic risk has the board not discussed deeply enough this year?
- And finally, if the organisation’s boda-bodas are heading toward a dangerous intersection, will this board see it first or will the crash announce itself to the market?
Because the best boards do not simply attend meetings. They watch the road.
I remain, Mr. Strategy
