> ## Content Index
> Fetch the complete content index at: https://www.thedecisionlayer.online/llms.txt
> Use this file to discover other available public pages before exploring further.

# The Decision Layer #24: Risk Must Enter Before the Decision
- URL: https://www.thedecisionlayer.online/decision-layer-24-risk-before-the-decision/
- Published: 2026-10-20T16:57:00.000Z
- Updated: 2026-10-20T16:57:00.000Z
- Author: Maman Ibrahim
- Tags: The Decision Layer®, Strategic Risk, Risk Governance, Decision Architecture, Strategy, #decision-layer-series, #issue-24

Issue 24· 7 min read· Board Members · C-Suite · Senior Risk Leaders 

**This week:** A global retailer makes a major market entry decision. Risk management is involved six weeks after the decision is effectively made. The risk team produces a risk assessment nobody uses. Why strategic risk governance fails when it arrives after the decision, not before it. The risk-at-the-table model. One integration test.

01THE SIGNAL

Sharp. Not sentimental.

## The Strategy Team Made the Decision. Risk Management Arrived Six Weeks Later.

A global retailer decided to enter three new markets simultaneously over an 18-month window. The decision was made at executive committee, developed by the strategy function over four months, and presented to the board for approval.

The risk function was briefed six weeks after the executive committee decision. They were asked to produce a risk assessment for the board paper. They did. It identified twelve material risks. The board approved the strategy.

Two years later, the market entry had produced significant write-downs in two of the three markets. The postmortem identified that several of the twelve risks in the original assessment had materialised in sequence. The risk team noted that three of them — supply chain concentration, regulatory complexity, and consumer credit exposure — had been identified before the decision was effectively made, and could have altered the market selection if surfaced earlier.

Risk management had arrived six weeks after the decision. The assessment arrived in time for the governance. Not in time for the decision.

02THE PATTERN

Honest. Not accusatory.

## Risk Management Attached to Governance Processes Arrives After the Decision It Is Supposed to Inform.

The pattern is consistent across sectors. Strategic decisions are developed in strategy functions, finance functions, and executive teams. Risk management is brought in to assess the decision for governance purposes — board papers, audit committee presentations, regulatory submissions.

This sequencing ensures that risk management is always operating in retrospect. It can describe the risks of a decision that has already been made. It cannot influence the decision itself.

The consequence is visible in every postmortem of a major strategic failure: the risk assessment was produced, the risks were identified, the governance process was followed. And the decision was already irreversible before any of that happened.

Risk management that arrives after the decision is not risk governance. It is risk documentation.

The architecture problem is in when risk management enters the decision cycle — and in what form. Risk management attached to governance processes will always arrive at the governance stage. Risk management embedded in strategic decision-making arrives at the decision stage.

03THE MODEL

Simple. Not simplistic.

## The Risk-at-the-Table Model: Three Points Where Risk Intelligence Must Enter.

Strategic risk governance is not a separate process that runs alongside strategy development. It is intelligence that enters at three specific points in the strategy process — before each stage locks.

| ENTRY POINT               | WHAT RISK INTELLIGENCE PROVIDES                                                                                                                                       | WHAT CHANGES IF IT ARRIVES LATER                                                                                                                            |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Strategic options stage   | Risk profiling of each option before selection. Which options carry concentration risk? Which create regulatory complexity? Which depend on single points of failure? | If risk arrives after option selection, the option set is fixed. Risk becomes a constraint to manage rather than a criterion for choice.                    |
| Business case stage       | Quantified risk assumptions embedded in financial projections. What does the business case look like if the top three risks materialise in year two?                  | If risk arrives after the business case is built, the projections are already embedded in board papers. Challenging them requires challenging the strategy. |
| Governance approval stage | Independent assurance that the risk assessment is complete, calibrated, and connected to the appetite framework.                                                      | If risk first appears at this stage, it is governance theatre — documentation for approval, not intelligence for decision.                                  |

The first two entry points require a structural change: risk intelligence must be part of the strategy function's working process, not a handoff that occurs after the working process closes. The third entry point — governance assurance — is where most organisations currently operate. It is necessary but not sufficient.

04THE MOVE

Practical. Not obvious.

## Map Your Last Major Strategic Decision. When Did Risk Enter?

Pick the most significant strategic decision your organisation made in the last 18 months — a market entry, an acquisition, a major technology investment, a restructure.

Draw the decision timeline: when was the option set defined? When was the business case built? When was governance approval sought? Mark the point when risk management first substantively entered. Calculate the gap between that point and when the decision was effectively made.

If risk entered at the governance stage, your organisation has governance documentation but not strategic risk governance.

The gap you calculate is the window during which risk intelligence could have influenced the decision and didn't. For major strategic decisions, that window is typically four to six months. That's the time available to build the risk-at-the-table model before the next major strategic decision arrives.

05THE INVITATION

Open. Not pushy.

WHITE PAPER 

Why Risk Frameworks Fail at the Decision Layer

Covers the strategic decision gap in detail — including why risk management attached to governance processes will always arrive too late, and what connecting it to strategy development actually requires.

[Access here →](#) 

DIAGNOSTIC SESSION 

Book a 45-Minute Decision Architecture Conversation

If the timeline exercise produced a gap between when risk entered and when the decision was made, that gap is the right starting point. We'll map what the risk-at-the-table model looks like in your specific decision architecture.

[Book a diagnostic session →](#) 

That's *The Decision Layer* for this week.

The retailer's risk team did their job correctly. The governance process worked. The decision was already made. Getting risk to the table before the decision is an architecture change, not a process improvement.

Forward this to a strategy director or CFO who has ever received a risk assessment for a board paper and wondered what to do with it. The honest answer is: not much, at that stage.