Risk without resilience

Boards talk about risk appetite.

They rarely talk about recovery capacity.

Those are not the same thing.

After many years in business continuity and crisis management — including building KPMG Australia's entire continuity program — I've seen the gap up close.

A board can formally approve a risk appetite statement and have absolutely no idea whether the organisation could actually survive the risks it's just endorsed.

Resilience isn't a policy. It's a capability.

And it has to be tested before the crisis, not discovered during it.

Most organisations never exercise their crisis protocols. They approve them. They file them. They move on.

Then something goes wrong and everyone discovers simultaneously that the plan made sense in theory and fell apart in practice.

The board's job is to ensure the organisation can actually perform under disruption.

That's a different conversation. And it needs to happen before the phones start ringing.

Is your board asking the right resilience questions — or just the comfortable ones?