Ep. 39: Rewiring Enterprise Risk Management

Full transcript

Bobbie Ramsden-Knowles: Hello, everyone, and welcome to the Emerge Stronger Through Disruption podcast series. I’m Bobbie Ramsden-Knowles, co-leader of PwC’s Global Centre for Crisis and Resilience, or GCCR for short, and I’m coming to you from our offices in the UK today.  

The aim of the podcast series is to really explore the challenges facing businesses in this environment of constant crisis and change, and to discuss how successful business leaders can emerge stronger through that disruption. 

​​Before we dive into today’s conversation, if you’re enjoying the Emerge Stronger Through Disruption podcast series, please subscribe wherever you get your podcasts and consider leaving a like or a comment. Hearing from you helps us know that we’re connecting, and it also helps more people discover the show. We really appreciate your support.  

​​​Today we’re discussing enterprise risk management, or ERM, and importantly, its value in organisational resilience. Joining me today to explore the topic is Callum Bright, a director who is PwC UK’s Enterprise Risk Management leader, and he focuses on helping organisations modernise their ERM capabilities. 

​​​Welcome, Callum. 

Callum Bright: Thanks, Bobbie. It’s great to be here today.  

Bobbie Ramsden-Knowles: ​​Callum, you know I love this topic ’cause you and I have talked about it for many months now, and we often hear and speak to executives who are struggling to define ERM’s value in the context of their broader resilience efforts, and ​​that link between risk and resilience. 

So I’d love today to help bring some clarity to that topic. What do you say?  

Callum Bright: Absolutely, Bobbie. As you said, we’ve been talking about it for a long time now. I think risk and resilience are definitely coming closer together in this world that we live in at the moment. It doesn’t mean that they don’t stay as separate things in themselves, but they are definitely coming closer together. 

Bobbie Ramsden-Knowles: Yeah, you’re spot on. It’s a really important topic. I think that organisations clearly expect uncertainty and disruption now. That’s a given, and many leaders will already have been through acute events. We’ve seen huge amounts of different types of disruptions in the last couple of years even. Cyber events, supply chain shock, huge regulatory intervention, but also market volatility and obviously operational failures.  

So it’s clearly natural that they can start to see this link between risk and resilience. But in practice, what does that actually mean, Callum? ’Cause I think there’s a lot more to this subject than perhaps has been explored before. 

Callum Bright: I think the starting point is that disruption rarely behaves in the neat categories organisations create to manage it. A risk might be labeled as cyber, operational, third party, conduct, or financial, but when it materialises, it quickly cuts across teams, processes, customers, suppliers, technology, or governance. 

In a crisis, I think the organisational boundaries that feel logical in a business-as-usual state often become less relevant than the dependencies that actually determine whether the organisation can keep operating or not. This is where risk management and operational resilience have a shared purpose. 

They’re both about helping organisations make better decisions under uncertainty. Before a disruption, that means understanding what matters most, where the organisation is exposed, what assumptions are being made, and which capabilities or dependencies need to be protected. And during and after a disruption, it means helping leaders interpret fast-moving information, making trade-offs, adapting plans, and learning from what happened. 

The link is more than simply aligning risks to controls or risks to resilience activities. That can be useful, but I think it misses the bigger point. I think the real value comes when risk and resilience together gives leaders a clearer view of how disruption could move through the organisation and help them make higher quality decisions with those risks and uncertainties clearly in mind before, during, and after disruption. 

Bobbie Ramsden-Knowles: So I love that point you made that they’re both about helping organisations make better decisions under uncertainty, and that makes a huge amount of sense. Surely that means this is ERM’s time to shine right now. But it doesn’t really feel like that’s happening. Why is that? 

Callum Bright: Absolutely it is ERM’s time to shine, Bobbie. 

Why is that not happening in all organisations? I think in a lot of businesses, ERM still relies heavily on a process-led, backward-looking view of uncertainty. We identify risks, we classify risks, we review them on a regular cycle, and then we report them through established governance, often after all the decisions about those risks have already been made. 

What’s not happening is risk is being dynamic, and it’s not decision-focused. It’s still too siloed and static. The result is a critical gap between where risk is created through decisions and where those risks are then reviewed. I think that gap exists in part because risks move across functions, they expose hidden dependencies, and they combine in ways that traditional risk categories rarely capture. 

I don’t think ERM is obsolete, and some people have talked about that. But I think it is in need of reimagining. I think it needs to move beyond the process as the main measure of whether ERM is effectiveness or not to rewiring ERM around the decisions that shape the organisation’s exposure.  

Bobbie Ramsden-Knowles: I’ve really caught on to that point you just made that ERM is in need of reimagining. That makes a lot of sense to me. But then what are some of the concepts you feel that actually are outdated and we need to stop doing, retire, if you like?  

Callum Bright: There are three concepts for me that have been a big part of some businesses up to now that I think really need to be let go of. 

The first one is this concept that risk is opportunity. Absolutely, organisations do take risks to create value. But when we’re talking with organisations, most senior leaders still use risk in its most practical sense. What are the bad things that could happen and affect performance or our ability to meet our objectives? 

I think there’s a risk otherwise that risk functions become substitute commercial teams trying to prove their relevance. Really, a risk team’s distinctive contribution is to make opportunity more robust by testing assumptions, clarifying downside, and also helping leaders understand what is being staked. 

​​​Effective ERM teams can help leaders and organisations see things they otherwise wouldn’t in the moments that matter. For example, I can think of one business that’s reframing how it wants its risk team to add value by really leveraging its unique team skills around playing a formal devil advocate’s role and red teaming big investment decisions so there are some really tough questions up front. 

Another term that I don’t believe is that helpful is this idea of putting risk-based in front of every activity. So you’ll often see risk-based planning, risk-based prioritisation, risk-based decision-making. They might all have value as terms, but I think the language can sometimes be a bit self-referential. The aim isn’t to make the organisation speak risk’s language, but it’s for risk to help the organisation make better choices. 

On a similar note, I don’t think broad talk of risk culture is particularly helpful. Culture absolutely matters, but I think that phrase “risk culture” can be too vague to act on, and expecting what can often be a relatively small risk function to change entire organisational cultures, I think is unrealistic. 

What is more useful is a focus on specific behaviours. Do leaders invite challenge early enough? Are weak signals escalated? Are assumptions tested while there is still time to change course? I think ERM becomes more practical when it moves from abstract cultural change to targeted behavioural intervention. 

Bobbie Ramsden-Knowles: Really helpful, Callum. Thank you. So I would say that those are three pretty straightforward concepts that risk leaders now can let go of quite quickly or adjust and consider how they’re approaching it to set themselves up for success going forward. So why don’t we now talk about the bigger shifts that are actually needed to rewire? 

You mentioned rewiring ERM. What are the biggest shifts needed so it’s actually fit for purpose, it’s actually gonna deliver value for the business? What are they? 

Callum Bright: ​​There’s three big shifts really that we’re focusing on in ERM.  

The first is to focus on decisions, which I’ve ​hinted at a bit already. Risk emerges through the choices organisations make, from strategic bets to everyday operational decisions, but those choices are made through conversations, assumptions, and informal judgment long before they appear in risk reporting in a governance or investment committee pack. That creates a timing problem. 

Many organisations, as I talked about earlier, are still reviewing risks after strategies have been set, maybe programmes have started, and actually maybe even resources have been committed. The real test is whether ERM is present in both the formal, but potentially more importantly, the informal moments where choices are being made rather than generating reporting on risks after those conversations have happened. 

For me, a rewired ERM model would look further upstream. It would ask where important decisions are actually made sort of in the wild, what assumptions are being carried forward, and where challenges would be useful before momentum becomes difficult to reverse. That applies not only to major strategic choices, which is often a space that risk plays in, but also to the controls, routines, and processes through which thousands of individual decisions are made every day. 

Used well, this can help risk teams improve the quality of those decisions before outcomes are locked in. Been talking to a few organisations who, for instance, on the back of a risk appetite refresh, are not only looking at their strategies, but are changing policies, processes, and behaviours in the organisation to reflect how their leaders want their people to make daily choices. 

This is great management by design by making good decision-making easier to do. I should mention though, Bobbie, that risk teams often face two challenges with moving to a decision-focused approach. One, identifying what are the types of decisions and the decision-making forums where they should concentrate their time and efforts. 

As I said, often they’re small teams and they can’t be everywhere. And two, where they’re not currently part of those decision-making points or forums, how do they obtain invitation or permission to be part of those? 

Bobbie Ramsden-Knowles: Got it. So basically, the metric of value here is are better decisions being made because risk expertise is present at the right time and in the right form. So what’s the second shift, then? 

Callum Bright: The second shift, Bobbie, is to prepare for how disruption really moves. Risk categories, risk registers, and controls create helpful structure, but they can also trap ERM teams in an abstract view of prioritisation. If a risk feels important, the organisational instinct is often to define it more precisely, increase the precision of that risk description, add more controls, or assign it to a more senior owner in the business. 

That can be useful, but it doesn’t necessarily answer more practical questions, what decisions would need to change and how, and what would really matter if the organisation came under acute stress. This is where scenario-based thinking and the idea of Minimum Viable Company, which I know is a topic you’ve covered on a previous episode, Bobbie, are so valuable. 

Instead of starting with a taxonomy of risks and objectives and asking which controls attach to each one, ERM can start with a disruption scenario and ask, “What must keep working for the organisation to remain viable? Which services, processes, people, suppliers, systems would matter most? Where are the dependencies, single points of failure, or vulnerabilities that would shape whether the organisation could continue to operate?” 

This gives ERM teams a much more real-world way to think about risk prioritisation. It moves the conversation beyond just lists of risks and controls and towards the capabilities and dependencies that would actually determine organisational outcomes. In that sense, MinimumViable Company thinking is an elegant way to address the reality that risks don't behave in the same way organisations are structured. 

It helps ERM focus on what really matters under pressure, rather than assuming that the most complete risk register is the same thing as the clearest view of risk exposure. I don’t think the MVC lens completely replaces the need to identify risks to your longer-term strategic objectives, but an organisation will never be able to meet its objectives if it hasn’t properly managed the risks to the organisation’s ability to survive in a crisis scenario. 

For me, it’s a helpful alternative risk prioritisation lens rather than a replacement.  

Bobbie Ramsden-Knowles: I agree, Callum. When we talked about MVC on the previous podcast, it is about looking at the core of the business. So I think it’s a helpful framing for ERM, but you’re absolutely right to call out that it’s not the only consideration for ERM teams. 

Really helpful though to link the two. I don’t think I’ve seen many others do that actually. Could you maybe come to the third shift now of what you’ve seen when you talk about this rewiring?  

Callum Bright: Absolutely, Bobbie. The third shift is to rewire ERM to be human-led, but AI amplified. 

Automation may create efficiency, but it doesn’t necessarily improve judgment. The more important question is, how can AI extend the reach and imagination of risk teams? This is a really popular topic with organisations at the moment, and AI can often help reveal patterns that traditional risk analysis may miss and help leaders ask better questions under uncertainty. 

I’m often splitting use cases into two buckets. So one being, how do you make your current processes more efficient? But the other one, which I think is a more interesting discussion, is what processes can you transform because of the availability of artificial intelligence? 

I’ve seen some great practical use cases. I’ve seen organisations using agents to deliver 24/7 risk horizon scanning. They’re using AI to generate and explore risk scenarios at real pace. I’ve even seen one organisation recently who’s got leadership’s buy-in to have a risk identification agent present in key important decision-making forums that’s actually ambiently listening out for risks that are discussed as decisions are made in real time. This is removing the need for backward-looking one-on-one risk assessment interviews with senior management after those decisions have already been made.  

What I would call out, Bobbie, though, is that ERM should remain a human-led discipline. The most important risk judgments involve ambiguity. They involve complexity and behaviour under pressure. AI can help expand the field of view, but it’s people that are still needed to interpret what matters and decide where to intervene. The aim should be for AI to amplify judgment, not create the illusion of automated certainty. 

Bobbie Ramsden-Knowles: If I just summarise one point, though, what you’re saying is that these three shifts, you’re not implying that ERM should abandon discipline or governance or control, but actually it’s about aiming at something that provides more valuable purpose. 

Callum Bright: I think the future risk function should be more outward-looking, more collaborative, and closely connected to the decisions that shape the organisation’s risk exposure. The function should really be there to help leaders understand uncertainty before choices are locked in, build preparedness around the capabilities and dependencies that matter most, and use AI to strengthen rather than replace human judgment. 

Bobbie Ramsden-Knowles: Brilliant. Thank you, Callum. That was incredibly insightful. I’ve heard lots of different new points of view there, despite the fact you and I talk at length about this topic. Listeners, Callum has recently published a paper on the topic as well, which you can find on PwC's website if you'd like to learn more. 

With that, I think that is a great place to wrap up today. So to our listeners, thank you so much for tuning in. In upcoming episodes of Emerge Stronger Through Disruption, we’ll continue to tackle the topics that keep business leaders up at night. And as always, we’d love to hear ideas from you about the areas and the topics you’d like us to address. 

So please get in touch with me or Callum via LinkedIn. And in the meantime, remember to subscribe to Emerge Stronger wherever you get your podcasts. Until next time, stay resilient and prepared for whatever challenges come your way. 

© 2026 PwC. All rights reserved. PwC refers to the PwC network and/or one or more of its member firms, each of which is a separate legal entity. Please see www.pwc.com/structure for further details. This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.