Here is the essence of a conversation I had with a senior leader in a large publicly listed company:-

Me: How’s business?

Senior Leader(SL): Great!

Me: That’s good! All your major projects are going well?

SL: Yes, all good!

Me: How’s your risk function going?

SL: Not great. People just treat it as a tick-the-box exercise.

Me: Why do you think your major projects are so successful then?

SL: Oh, we use the Red Team vs Blue Team methodology that came out of US Defence. It is when we form a second team, the red team, and get them to critique the project team, the blue team. The aim is to check assumptions, identify potential roadblocks and look for better ways of achieving the project goals.

Me: That’s risk management!

SL: Well (pause) yes, you’re right, it is risk management.

The interesting thing is that without some of the key elements of the risk process, the Red Team methodology can be flawed. Identifying challenges and opportunities without having a methodology for prioritising them is the key issue. What is a big challenge to you may be an even bigger challenge for someone else. That is, risk is subjective. The risk process provides a way of bringing everybody’s “assessment” onto the same page.

The elephant in the room here is not the deficiency of the red team approach, it is the failure of management to ensure it gets value from its expenditure on risk. For this organisation, and for many more, their expenditure on risk was essentially a waste of money.

You can’t afford to throw away money these days. You simply can’t.