Companies are facing disruption at an unprecedented rate. Quite a few have found themselves woefully unprepared for what lies ahead.

Risks and risk governance have thus become hot topics in the boardroom. Directors are being challenged to reassess their board’s mandate. Questions over the board’s core governance processes, and the fit between directors’ skillsets and evolving business landscape need to be addressed.

Yet, amidst all this uncertainty, the board in strategy-setting needs to have a tacit understanding of what truly are the risks that threaten the future of the business. Just as risks should not be viewed in silos, risk management should not be isolated from strategy.

Risk governance at the board level has to help the company be agile and forward-looking. Hence, the board has a responsibility not only to mitigate risks, but to also identify the ones that are worth taking. Put in context, an effective driver is not one who is stuck staring down the rear-view mirror, but one who is focused on the road ahead while occasionally checking what’s behind and around.

We often speak about good governance being a balance of performance and conformance. In truth, many discussions around risk management practices focus excessively on risk prevention and avoidance. The irony is that once this becomes the sole basis of how a board makes its decisions, it is, in fact, introducing yet another risk in and of itself. A board that is predominantly obsessed with risk control is less effective in navigating a future where bold, strategic risks need to be taken.

In their book Boards that Dare: How to Future-Proof Today’s Corporate Boards, authors Marc Stigter and Cary Cooper argue that the main starting point of the board should be about “realising future value within a certain time frame, within a certain risk appetite – in that particular order”.

Oftentimes, at the board level, many risk and strategy processes tend to be divorced from one another. Usually, the risk committee is focused on enterprise risk management, while strategy typically comes under the purview of a separate executive/strategy committee.

Presumably, everything gets reconciled at the main board in the end. Still, it would make more sense for these two committees to be more deliberate in sharing relevant, specific information with each other. Members from the strategy committee should regularly be invited to sit in on the risk committee’s sessions, and vice versa.

In bringing together strategy and risk functions, the board should have a risk governance framework that includes identifying business and strategic risks. These risks should be factored in during the deliberation and formulation of the organisation’s business strategies. Strategic risk indicators should also be captured as part of the performance indicators that have been set.

From dealing with “black swans” to “grey rhinos”, from highly unlikely to highly probable incidences, what has become evident is that the growing list of issues appearing on boards’ radars is becoming increasingly complex and varied.

The challenge when it comes to strategy is that the line between board and management tends to be blurred. A delineation between board and management’s responsibilities remains more art than science, however.

The common understanding is that boards need to have a “hands off and noses in” approach  to preserve their independence. But who is ultimately responsible for setting strategy, especially in unprecedented times like this?

The board cannot be the sole custodian of strategy, but neither can management go at it alone and relegate the board to “rubberstamping” duties. How involved, then, should directors be throughout the strategy process?

There are voices advocating a more hands-on approach, moving away from the review-and approve practice many directors are accustomed to. The argument for this is that given the uncertainty faced, the traditional cadence of board meetings today is inadequate, and an increased degree of board engagement is thus required. Where this becomes controversial is when boards start to wade into the realm of execution and implementation.

The sweet spot is likely somewhere in-between. The board should rely on the domain expertise of management, while leveraging its own diversity of knowledge and experience to refine the strategy and provide guidance. Regardless, whether in crisis or business-as-usual, how the board operates should always reflect the particular needs of an organisation rather than simply applying theoretical best practice. (See box, “Common Practices of a Proactive Board”).