Strategic risk management features in most organisations' annual plans. There is a risk paragraph, a top-10, an appetite statement, sometimes an attractive model. But look at major decisions: proposals are already well advanced before risks are seriously weighed. The lists trail behind the choices.
The strategic risk radar turns that around. The starting point is not the list, but the question: which risk gets which position on the radar, what that means for those looking at it, how often it recurs and how quickly you need to act.
The radar as a boardroom table
The strategic risk radar is a boardroom table on paper. At a single glance, it shows which uncertainties are appearing on the horizon, which you are actively tracking and which you are bringing inward as concrete action items.
The radar consists of rings and quadrants.
- The rings indicate time and urgency.
- The quadrants represent the thematic perspective: people & culture, market & regulation, technology, financial, operational.
Where you place a risk on the radar determines the conversation you have about it. A theme in the outermost ring calls for a different conversation than a theme in the innermost circle.
Four zones, four types of conversation
Divide your radar into four zones and link each zone to one type of board-level conversation. The closer a theme is to the centre, the more concrete the conversation becomes.
1. Beyond the horizon - explore
The outermost zone is "beyond the horizon". It contains topics you see coming, but to which no decisions are yet attached. Early signals from society, new technology, initial discussions on regulation, changing customer behaviour.
Conversation type: explore.
- What are we seeing happen?
- Who is already noticing this?
- What could the potential consequences be for our role, value chain, assets?
No choices need to be made yet. The point is that the theme has a fixed place and does not come to the table as "new" every time.
2. Horizon - take a position
One ring inward lies the horizon. Topics here are no longer non-committal. They are getting closer, the first tangible effects are becoming visible and there may already be workstreams or studies underway.
Conversation type: position.
- Do we want to engage with this or not?
- What is our position if this continues?
- What does that mean for our strategy and our profile?
In this zone, the board and executive management adopt a deliberate stance. Not a detailed plan, but a clear "leaning yes" or "leaning no".
3. Monitoring - track and prepare
The next ring is the monitoring zone. Risks that are close enough to track in a structured way, but where major interventions are not yet needed.
Conversation type: steer on information.
- Which indicators are we tracking?
- Which scenarios are we using?
- When does this move to action?
Ensure themes from the monitoring zone recur in your dashboards, periodic reports and management discussions. They are still strategic, but are already receiving a tactical translation: measurement points, triggers, scenarios.
4. Action - translate into concrete steering
In the innermost circle lies the action zone. Risks that are so close that tracking alone no longer suffices. Here you must make choices.
Conversation type: decide.
- What are we going to do, with what budget, in what order?
- What gives way, what do we defer or stop?
- Who is the owner and what do we steer on?
This zone is also the link to tactical risk management. Everything in the action zone should visibly feature on the tactical risk heat map, with concrete measures, actions, deadlines and accountable owners.
From radar to tactical heat map: the decision point
The strategic radar and the tactical heat map are not duplicate records. Each serves its own function:
- The radar: which strategic risks are relevant, and where do they sit in terms of horizon?
- The tactical heat map: which risks are we actively managing in processes, projects and departments?
The intersection lies at the monitoring and action zones.
- Themes in monitoring: must at minimum be recognisable in the tactical risk picture, for example as a category or "watch list". There needs to be visibility on where the risk could materialise.
- Themes in action: receive a concrete place on the heat map, with measures, controls, projects, actions.
This is an explicit choice by the board and executive management: nothing enters the action zone without a deliberate discussion. Nothing remains permanently in monitoring without someone questioning whether that is still appropriate. And conversely: no overloaded tactical heat map with topics that were never on the radar. This prevents everything becoming "urgent" and nothing remaining strategic.
Practical tip: make the link tangible
Treat each item on the radar as a card on your tactical heat map. For each card, record three things: who is the process owner (a person, not a department), when must it be completed (derived from the ring in which the item sits), and which indicators are you steering on. This prevents duplication of effort and keeps the line intact: radar, heat map, measure. No translation step, no retyping.
What goes wrong when the radar remains a picture
Without discipline around the radar, the same patterns keep appearing.
- Risks appear directly in the action zone as soon as an incident occurs, without a deliberate horizon or monitoring discussion ever having taken place.
- New regulation (such as DORA or NIS2) is picked up as a technical compliance project, while the strategic impact on value chains, continuity and reputation is barely discussed.
- Themes drift along in the outer rings for years, everyone knows them, nobody attaches a clear position or action to them.
You then have a radar, but no strategic steering. The model exists, the governance is on paper, but the behaviour is ad-hoc and incident-driven.
Board and supervisory board: using the radar as a framework
For the board and supervisory board, the radar is primarily a tool to structure their own discussion. A few concrete agreements already make a significant difference:
- At least once a year, a session in which the radar is recalibrated: what is added, what moves inward, what can be removed?
- With every major strategic decision: explicitly ask where the relevant theme sits on the radar and whether that position is still accurate.
- Dare to shift: themes that are already causing concerns and incidents do not belong in beyond the horizon or horizon, but in monitoring or action.
- After major programmes conclude: look back at where the theme sat on the radar at the time, what assumptions were made and what came of them.
This makes the radar a permanent part of the decision-making process, not just the risk paragraph.
Risk: curator of the radar, not owner of the strategy
The risk function does not need to determine the strategy, but does play a central role in maintaining the radar. Key tasks:
- Signal: translate developments, incidents, supply chain risks, supervisory trends and internal findings into proposals for the radar.
- Structure: ensure consistent criteria and language when placing and moving risks between zones.
- Connect: link monitoring and action items to the tactical heat map, so it is clear where in the organisation they land and who is the owner.
- Report back: periodically show which radar items have been moved forward, which have progressed to action and which remain outstanding.
Crucially, risk does not populate the radar on its own. The classification is a board decision. Risk organises the process, safeguards quality and records what has been agreed.
Internal Audit: reality check on the radar
Internal Audit can assess whether the radar works in practice as agreed. Not by adding yet another model, but by examining real decisions. A possible approach:
- Select a number of major decisions from recent years: investments, IT programmes, reorganisations, strategic partnerships.
- Place the decision documents alongside the radar history: where did the relevant theme sit on the radar at the time? Has there been a shift between zones?
- Check whether items in the action zone feature in the tactical heat map and in management reports.
- Identify where it chafes: themes that remained in beyond the horizon while incidents were accumulating, or topics in the action zone without clear tactical follow-through.
Audit does not need to judge whether the strategy is "good". Audit assesses whether the agreed use of the radar is being followed, and what that says about the governance of strategic risks.
A compact radar test for the board and supervisory oversight
An organisation that wants to strengthen this starts by asking itself a few questions:
- Name three themes currently in the action zone. What decisions have we taken on them in the past twelve months, and where do we see those reflected in projects, budgets and measures?
- Which topics have been drifting along in horizon or monitoring for some time without a clear position or action attached? Why do they remain there?
- Which recent incident or external pressure could have been visible earlier as a radar item? Was it on the radar, and if so: in which zone?
- How transparent is the process of shifting: who decides that a theme moves from beyond the horizon to horizon, monitoring or action, and is that recorded?
From there you build further: sharpen agreements, delineate the roles of radar and heat map more clearly, give concrete shape to the collaboration between the board, risk and Audit.
Start tomorrow: three steps in thirty days
- Recalibrate your top-three action items. Place them alongside the minutes of your last supervisory board meeting. Were they on the radar beforehand? If not: why not? That is precisely the kind of blind spot the radar is designed for.
- Schedule a horizon conversation. Choose one external theme, for example new regulation, and discuss only the exploratory questions from the horizon zone. Forty-five minutes is enough. The aim is not to find answers, but to sharpen the right questions.
- Test the link with your heat map. Take an item from the action zone and trace it in your tactical risk report. If it is not there, you know where your process or tooling falters. That is not failure, that is a gain: you have found the seam before things go wrong.