Risk in the Round: From Compliance to Strategy, and the Generational Fight

Sabrina Segal told a story on this episode about being accused of being too strategic. A prospective client had decided, in so many words, that her approach to risk was a bit much for what they had in mind. She took it to LinkedIn at the time, the community helped her think it through, and she told it on the episode with a laugh. We keep coming back to that story because of what it accidentally photographs: a sector in which strategic is something a risk person can be accused of.

The default it photographs is risk as compliance. A list of bad things that might happen, scored with some impact-times-likelihood arithmetic, filed in a register the length of a small annex, dusted off once a quarter and handed to the trustees. Sabrina Segal is the Director of The Risk Collaborative, and the work she described on the episode runs almost exactly the other way.

Six Words

The definition she pointed to is not hers. It belongs to the International Organization for Standardization, ISO 31000, and it is six words long: the effect of uncertainty on objectives.

Read it slowly, because two things fall out of it that the compliance version hides. The first is that risk starts with an objective, not with a threat. You begin with what the organisation is actually trying to achieve, and you do the analysis outward from there. The second is that uncertainty cuts both ways. Threats on one side, opportunities on the other. A risk process that only ever asks staff what could go wrong is throwing away half of their judgement and half of the actual picture. That reading is ours, but it is hard to sit through the episode and come away with a different one.

The Tick-Box and the Map

The conversation kept circling the difference between a register and a map. The traditional register is linear. It lists, it scores, it files. The way Sabrina described her work with organisations, it lands closer to a systems map, though by her own telling she avoids the phrase systems thinking in the room, because it makes people freeze. Colours and a board instead, and start with the objective. What will prevent us from reaching it. What will accelerate it. Who needs to be in the conversation before it is set.

Ali Al Mokdad added a layer from the operational side. Risk means different things depending on where you sit. At field level it is access, safety, security. At country level it becomes compliance and positioning and how you treat your local partners. At headquarters it is enterprise risk, reputational risk, the flashing Excel sheet. Same word, different worlds. He also named the quieter truth: at country level you sometimes brand something as a risk precisely because that is the word that gets headquarters to pay attention. The register is not only a control. It is a political instrument.

The Chain and the Rope

Here is where the episode turned from interesting to important. The dominant way the sector handles risk is to transfer it. The highest-power, best-resourced player passes the risk down to the lowest-power, least-resourced one, and calls the paperwork due diligence. Picture delivery as a chain, and the weakest link is the one that breaks.

The image Sabrina set against that is a woven rope. Risk sharing instead of risk transfer. The funder's concerns woven toward the frontline, the frontline's concerns woven back toward the funder, and the risk carried by whoever is actually positioned to carry it rather than dumped on whoever has the least power to refuse it. She was just as plain about what she was not promising:

Shift the power is a great slogan. I don't think it happens in reality. But balancing the power, that we can actually do.

The structure she walked through is her three P framework: Project, Partner, Patron. Everyone agrees on the project objective. Reduce maternal and child mortality, protect the forest, check on the elderly through winter. But the funder, the intermediary, and the local partner each see the risk of that objective differently. So the partner is asked, not whether they are high, medium or low risk against a Western checklist, but what their risk capacity is inside their own operating environment. The example she used has stayed with us: a women's organisation in Sudan that cannot buy insurance, because there is no insurance market to buy it from, is not high risk. It is operating in a context the checklist was never written for. And the patron, the funder, is asked to plot themselves honestly on a line from command-and-control to trust. In her experience, most say trust and land closer to control. Now there is data and a shared language, instead of a power imbalance dressed up as assurance.

Coffee Without Cream

Ali Al Mokdad offered a story that reframed the whole thing. A man walks into a cafe and orders a coffee without cream. The waitress says, sorry, we have no cream, but we can do you a coffee without milk. Chemically the cup is identical. Black coffee either way. But the moment you look at what is missing, you stop talking about materials and start talking about ideology, about class, about how a place sees itself.

His point: risk management without the Excel sheet is not the same thing as risk management with it, even when the thinking is identical, because for a large part of the sector the register is not a tool. It is a culture, an ideology about what serious operations are supposed to look like. The first thing people notice about a new approach is not what it delivers. It is what it leaves out. And when you start pulling on what it leaves out, you find the problem was never the tool or the technique. It was the philosophy underneath.

Don't Predict, Prepare

On threats, one line from Sabrina stuck: do not predict, prepare. The sector pours enormous effort into predicting the next shock and very little into knowing where it is already fragile. Over-reliance on one large funder sat on risk registers across the sector for years. How much good did the register do when the funding actually disappeared? Most organisations found out where they were fragile in real time, with no luxury to buffer or redesign first.

That is the work now, in the quieter aftermath. Stand back and ask which fragilities are inherent, so they need buffering, and which exist only because nobody has been willing to redesign them. Then have the hard conversation about scope. What is the mission, where did scope creep in, what gets doubled down on. The organisations Sabrina described coming through this in one piece are the ones being honest about that with their boards and their staff, rather than the ones still doing something for the seventh year because they once promised the board they would.

The Generational Fight

Near the end, the conversation stopped being about risk at all. Ali Al Mokdad named what he thinks this generation is actually for:

Those who came before us set the foundation. Our job is to clear out the outdated governance and the nonsense, so the people who come after us can focus on the real problems. This is our generational fight.

The annexes nobody will ever implement, the process fetish, the structures that exist because they have always existed. Clear them out, so the next people can spend their energy on climate, on hunger, on health. Sabrina's answer ran tactical: if the language of risk is the Trojan horse that gets risk sharing and localization into the rooms where funders actually sit, use it. People in power lean in when you say risk. They glaze over at psychology and they run from systems change. Use the entry point you actually have. Kim Kucinskas had her own name for the same move: a crack of opportunity.

Thomas Jepson-Lay closed by reducing the whole hour to one shift. Stop managing risk as a compliance strategy. Start managing the risk of not meeting your objectives. Kim called it risk in the round. It is a small reframe with a large door behind it.

A note on these notes, because this page promises honesty about how it is made: this essay is our reading of the conversation, drafted from the episode transcript. The two quoted passages are as spoken on camera. Everything else is interpretation, and the episode itself is the place to hear Sabrina make her case in her own words.