Strategic Risk Must Shape Decisions From the Beginning

Strategic risk management should no longer be treated as a control function that evaluates decisions after they have been made.

Instead, organizations should embed resilience and risk expertise from the earliest stages of business planning, enabling executives to make informed choices while balancing innovation, operational resilience and long-term growth, senior industry practitioners have said.

Speaking at CeFPro's Risk Americas 2026 conference, panelists agreed that while many of today's headline risks are familiar, their scale, interconnectedness and strategic implications have changed dramatically.

Cyber threats, technology dependencies, artificial intelligence, third-party concentration and geopolitical instability are no longer isolated operational concerns but increasingly influence enterprise strategy and board-level decision making.

The Head of Resilience at a major international bank argued that organizations continue to face many of the same categories of risk they have managed for years, but concentration across critical technology providers has fundamentally altered the conversation.

"I don't think any of the risks have really changed," she said. "It's technology, it's third-party supplier risk. I think it's the concentration of all of that and the convergence of all of that."

She explained that executive teams are increasingly weighing difficult trade-offs around resilience investments, dual vendor strategies and contingency planning as reliance on a relatively small number of critical suppliers continues to grow.

The Head of Operational Resilience and Business Continuity at a major international banking group echoed those concerns, highlighting cyber risk as the issue dominating executive attention.

However, she emphasized that effective resilience extends beyond preventing attacks.

"If we can't prevent it, what are our continuity plans? What are our contingency plans?" she asked, stressing that institutions must fully understand both their internal operating models and the external services supporting customers before disruption occurs.

Offering a different perspective, the Head of Enterprise Resilience at a major regional financial institution argued that organizations should also recognize the strategic risks associated with moving too slowly.

"For us, the way we think of AI being underutilized is a risk that's now emerging," she said.

The institution has formally identified insufficient investment in artificial intelligence as an emerging enterprise risk because falling behind competitors could ultimately affect customer retention, product quality and long-term competitiveness.

Geopolitical uncertainty has similarly become an increasingly important strategic consideration as global events rapidly reshape executive priorities.

Despite growing enthusiasm for AI, panelists repeatedly emphasized that successful implementation begins with understanding existing business processes before attempting to automate them.

Institutions must first simplify fragmented operating models, eliminate duplication and establish common standards before artificial intelligence can safely deliver meaningful value.

The resilience executive from the regional institution also warned that organizations may be overlooking risks associated with commercial AI models themselves.