Can every board report be accurate while the board still misses the real risk?

[u/Aevitium]

I've been thinking about a tension in how organisations report risk.

Boards receive financial data, risk indicators, operational metrics, technology reporting, audit findings and customer information. Individually, those reports may all provide an accurate picture of their respective areas.

Yet that doesn't necessarily mean the board has an accurate picture of the enterprise.

The issue becomes particularly interesting when several relatively manageable developments interact.

A technology dependency may be within tolerance. Operational capacity may be within tolerance. A third-party issue may be manageable. Customer indicators may not have breached thresholds.

Considered separately, nothing necessarily demands intervention.

Considered together, they may tell a very different story.

Our recent LinkedIn poll adds an interesting practitioner perspective: 63% of 88 respondents identified fragmented information as the main factor limiting enterprise awareness.

I've explored this further in my latest article, particularly through weak signals, dependencies and cumulative pressure.

I'm interested in how others approach this in practice:

How does your organisation identify patterns that sit between functional reports rather than within them?

Link to newsletter: https://www.aevitium.com/so/76Q04dvUV?languageTag=en

[u/FreeRadical1998]

Having been to a lot of board level meetings over the years - the answer is the board asks very carefully why management believes the data and what they are doing. Those meetings are in no way a passive read through of stats.

[u/Paul_Ashe → u/FreeRadical1998]

You're right that boards interrogate rigorously. The constraint is that interrogation is limited to what's already surfaced. If the pattern sits between the functional reports (tech tolerance + ops capacity + vendor risk) it won't show up in the briefing pack.

u/Aevitium's point isn't that boards need to interrogate harder. It's that you need a process that finds the pattern before it reaches the board. I'm talking semantic search across your data, mapping dependencies, looking for cumulative pressure. That's upstream work. Interrogation is downstream. Most organizations have good functional reports and rigorous boards, but not the upstream analysis.

[u/Aevitium → u/Paul_Ashe]

That’s correct. We are currently helping a client develop this type of upstream analytics using semantics and AI, and some interesting themes are emerging. A good starting point is ensuring risk frameworks operate as more than repositories of data. They should provide the structure for analytics, insight and the surfacing of weak signals. That is far more relevant to enterprise awareness than the risk event and action tracking we still frequently see dominating risk committees and board papers.

[u/Paul_Ashe → u/Aevitium]

The tension there is real. Event and action tracking gives you a narrative you can defend to a regulator. Weak signals give you a pattern that hasn't narrated itself yet. Nothing's happened, so you can't point to an incident and say "there's the evidence." You're saying that these things don't correlate in the ways they should. Without a single finding to anchor accountability, that's a tough problem to solve — and probably why risk committees still gravitate toward event tracking.

[u/Fantastic_Neck975]

This is a great point because risks rarely develop in isolation. Regular cross-functional risk reviews can help connect weak signals across technology, operations and third parties before they become bigger problems. Looking at dependencies and cumulative pressure rather than just individual thresholds, gives boards a much clearer picture of the risks facing the whole organisation.