Most organisations have risk frameworks, dashboards, and appetite statements in place. Yet significant failures continue to occur. The problem is rarely a lack of effort. It is where that effort is directed.

This article explores why measuring risk is not the same as understanding it, and why leaders need to examine the conditions that make harm possible before deciding how much risk they are willing to accept.