Strategic Risk

Risk is the price of having objectives, not a problem to be solved. This module builds a shared vocabulary using the ISO 31000 definition of risk, maps six families of risk, and explains Frank Knight's distinction between measurable risk and genuine uncertainty. It draws on the World Economic Forum's Global Risks Report 2026 and the Blockbuster case to show why strategic risk needs its own discipline.

Many organisations have a risk policy that nobody lives by, and that breeds cynicism. This module works through the eight principles of ISO 31000, the three lines of defence model, and the markers of healthy risk culture, including Amy Edmondson's psychological safety. Through the Post Office Horizon scandal and John Adams' risk homeostasis, it shows why culture, not policy, decides whether risk management works.

A strategy that has not been stress tested against risk is a wish list. This module separates risk to strategy from risk from strategy, drawing on Joel McPhee, and introduces Kaplan and Mikes's three categories of preventable, strategy and external risk. It uses Cheryl Strauss Einhorn's framework on data types and biases, and the WorldCom case, to show how to build risk into strategic planning from the outset.

When every department keeps its own register, no one sees the whole picture. This module explains what enterprise risk management adds beyond siloed registers, drawing on John Hampton's account of aggregated exposure, cross cutting themes and a common risk language. It works through the five components of the COSO 2017 framework and sets out what genuine implementation requires, so that one organisation has one risk picture.

The risks worth worrying about keep changing faster than the frameworks built to manage them. This module explains Nassim Nicholas Taleb's black swan and its three characteristics, uses the 2008 financial crisis to show an industry wide blind spot, and maps the frontier of digital, cyber, climate and geopolitical risk. Drawing on John Hampton, it sets out how to move from a static register to continuous risk sensing.

A risk you cannot name is a risk you cannot manage. This practical module works through the ISO 31000 process of identify, assess, treat and monitor, using Failure Mode and Effects Analysis, the Structured What If Technique and the risk assessment matrix, then sets out the four standard responses. The Airbus A380 case shows that good mitigation does not prevent every failure; it survives one.

Many boards approve a risk appetite statement that nobody can quote a month later. This module defines appetite, tolerance and capacity precisely, shows what makes a statement specific enough to change a decision, and explains why appetite must vary by category. Drawing on the Wells Fargo case, it sets out how boards monitor appetite between reviews and spot the warning signs of drift early.

A council cannot go out of business, and that changes who pays when risk crystallises. This module compares public and private sector risk, examining political, statutory and funding risk and how they compound. Through Thurrock Council's solar investments, it shows the danger of borrowing like a bank without governing like one, and sets out what each sector can borrow from the other without importing the wrong assumptions.

Reputation is not a risk category of its own; it is where every other risk eventually shows up. This module explains what makes reputational risk different, the three drivers that turn a failure into a crisis, and four features common to major risk failures, including normalised deviance. Using the Commonwealth Bank of Australia case, it sets out what separates genuine recovery of trust from a public relations exercise.

Leaders cannot control global risk, but they can decide how it shapes their planning. This module reads the World Economic Forum's Global Risks Report 2026 across two horizons: the loud, fast moving risks of the two year Age of Competition and the quiet, accumulating risks of the ten year view. Drawing on Kaplan and Mikes's external risk category, it sets out practical shifts for holding both horizons at once.

This capstone brings three real failures and every framework from the programme, with no new theory. You diagnose Volkswagen's Dieselgate emissions scandal, the collapse of Silicon Valley Bank and the failure of FTX before comparing your view with the frameworks in play, including normalised deviance, risk appetite ownership, COSO, the three lines of defence and Kaplan and Mikes's categories. It ends with a four move toolkit for your own organisation.

Most risk failures are not failures of process but of the probability judgement feeding into it. Drawing on Kahneman and Tversky, this module names three biases, availability, the law of small numbers and authority anchoring, and uses Feynman's analysis of the Challenger disaster to show a thousandfold gap in estimates. It sets out four debiasing tools, their pitfalls, and why fat tails, correlation and black swans mean the model is not the world.

ISO 31000 defines risk as the effect of uncertainty on objectives, positive effects included, yet most registers only manage the downside. This module extends the probability and impact matrix to capture opportunity, sets out three disciplines for a two sided matrix, and reads Pfizer and BioNTech's decision to manufacture a vaccine at risk. It explores survivorship bias, the conditions that justify a deliberate bet, and why inaction is also a bet.

A colour rating can rank attention but cannot say what a risk is worth. This module builds practical tools for valuing risk: expected monetary value and decision trees for choosing between options, and Value at Risk for sizing an exposure, with stress testing beside it. The collapse of Long-Term Capital Management shows why a precise number is not certainty. It closes with the economics of insuring versus self-insuring.

This closing capstone offers three more failures and no new theory: Barings Bank and Nick Leeson, the Deepwater Horizon oil spill, and the blocking of the Suez Canal by the Ever Given. You read each case first, then test your view against the frameworks in play, including the three lines of defence, Kaplan and Mikes's categories, fat tails, the two sided matrix and the four Ts, before planning how to use the toolkit at work.