How can risk leaders apply the Gray Rhino framework to risks their organisations already recognise?

In this RiskMasters — The Download, Michele Wucker, author of The Gray Rhino and You Are What You Risk, explains how she applies the Gray Rhino concept to risk management, risk identification and decision-making.

Her starting point is straightforward: organisations usually already know what their Gray Rhinos are.

They may involve succession, organisational culture, competitive pressures, finance and liquidity, regulation or other strategic risks. Michele’s approach starts by taking a fresh look at those known risks and assessing honestly how effectively the organisation is responding.

She explains how applying the Gray Rhino framework moves beyond identifying risk. Decision-makers need to understand who is affected, who has the power to act, how different risks interact and whether information flows effectively between frontline teams, management and the board.

The conversation also explores psychological safety, behavioural risk and risk culture. Michele explains why organisations need channels that allow people throughout the business to communicate what they see and ensure important risk signals reach those empowered to act.

The discussion then considers the relationship between quantitative risk management and behavioural factors, including how risks are interpreted, communicated and priced.

• How Michele Wucker applies the Gray Rhino framework
• Moving from risk identification to action
• How stakeholders and interconnected risks shape risk decisions
• Why psychological safety strengthens information flow
• How behavioural risk complements quantitative risk management

The Gray Rhino concept provides a practical framework for addressing high-probability, high-impact risks that are already visible. Michele shows how leaders can use it to examine organisational responses, improve risk communication and move from recognising a threat towards informed action.

This extract is taken from the full RiskMasters conversation with Michele Wucker on the Gray Rhino, risk management, behavioural risk and strategic decision-making.

Listen to the full RiskMasters episode on Apple Podcasts, Spotify or at aevitium.com.

What determines whether an organisation remains resilient when it comes under real pressure?

In this episode of RiskMasters, Julien Haye is joined by Frédéric Gielen, Executive Partner at Reply, to explore why organisational resilience is fundamentally a leadership and organisational design challenge rather than simply a matter of governance frameworks or regulatory compliance.

Drawing on more than three decades advising financial institutions, regulators and boards across Europe, Frédéric shares the recurring patterns he observes across organisations, explaining why resilience rarely fails through a single decision but instead erodes through rational trade-offs, fragmented accountability and unnoticed ambiguity.

Together, they discuss the relationship between risk management, operational resilience, governance, leadership, and organisational resilience, challenging conventional thinking about how resilient organisations are built.

In this episode, you'll learn:

• Why resilience is a leadership capability rather than simply a control function
• Why governance frameworks can appear robust yet struggle under stress
• The difference between documented capability and operational capability
• How weak signals become diluted as they move through organisations
• Why transformation often relocates organisational friction instead of removing it
• Why ambiguity in ownership, data and governance creates systemic risk
• How regulatory change exposes organisational capacity constraints
• Why resilience often competes with growth, speed and short-term performance

Whether you are a Chief Risk Officer, risk leader, operational resilience professional, compliance executive, board member or governance practitioner, this episode offers practical insights into strengthening resilience in complex organisations.

⏱️ Episode Highlights

01:15 – Why organisational resilience is a design choice, not a technical problem

08:39 – The gap between documented capability and operational resilience

17:53 – Why transformation relocates organisational friction

23:53 – How weak signals become diluted through escalation

29:57 – When mature governance frameworks fail under stress

39:31 – Why ambiguity creates systemic organisational risk

45:19 – Why resilience competes with organisational success

📚 Related Resources

Organisational Silos: The Hidden Cost of Fragmented Governance

Discover how fragmented accountability, disconnected decision-making and organisational silos create hidden vulnerabilities that only emerge under stress.

How Functional Silos Weaken Risk Identification and Escalation

Explore why weak signals become diluted as they move through organisations and how governance structures influence escalation and decision-making.

Psychological Safety in Risk Management

Learn why challenge, escalation and speaking up are essential to organisational resilience and effective risk leadership.

🎓 Download your CPD certificate:

⁠The CPD Group – Accreditation:⁠ #TBC

Most organisations look for major risks.

Frédéric Gielen argues that the biggest threats often begin with something much smaller.

Ambiguity.

In this RiskMasters: The Download, Frédéric explains why unclear ownership, fragmented data, and poorly defined responsibilities rarely create immediate problems but become systemic vulnerabilities when organisations come under stress.

He also explores another overlooked challenge. During periods of regulatory change, organisations often focus on budgets and implementation deadlines while underestimating their ability to absorb change.

We explore:

• Why ambiguity creates systemic organisational risk
• How unclear ownership compounds under stress
• The relationship between governance, data, and resilience
• Why organisations run out of capacity before budget
• How regulatory change exposes organisational constraints

Risk rarely grows because of a single failure.

It often develops where ambiguity, governance, and organisational capacity quietly intersect.

---

Music by Lexin_Music via Pixabay, used under the Pixabay Content License.

Strong governance frameworks are essential.

Clear responsibilities, documented escalation processes, and defined governance structures help organisations operate consistently.

Yet these same structures can become obstacles during disruption.

In this RiskMasters: The Download, Frédéric Gielen explores why governance frameworks that appear mature on paper may struggle when organisations come under stress.

Drawing on decades advising financial institutions, regulators, and boards, he explains how fragmented accountability, sequential decision-making, and misalignment between legal entity governance and operational governance can reduce organisational resilience when rapid decisions are required.

We explore:

• Why mature governance frameworks can fail under stress
• How fragmented accountability slows decision-making
• The tension between legal entity governance and operational governance
• Why governance structures should evolve for resilience
• The relationship between governance effectiveness and organisational resilience

Effective governance is not only about clear structures.

It is about ensuring those structures continue to support timely decisions when organisations face uncertainty and disruption.

Organisational resilience is often associated with governance frameworks, policies, and documented controls.

These remain essential.

However, resilience is rarely determined by documentation alone.

In this RiskMasters: The Download, Frédéric Gielen explains why organisational resilience depends on organisational design, decision-making, and behaviours that continue to operate effectively under pressure.

Drawing on decades of experience advising regulators and financial institutions across Europe, he argues that resilience rarely disappears through a single failure. Instead, it gradually weakens through rational trade-offs that appear reasonable when viewed individually but collectively reduce organisational control.

The discussion also explores the difference between documented capability and operational capability. Many organisations develop comprehensive governance frameworks, recovery plans, and resilience documentation. Under stress, however, those same organisations often discover that decision-making, escalation, and accountability do not operate as expected.

Another key insight is that resilience should be viewed as a design choice rather than a technical exercise. Governance frameworks provide structure, but organisational resilience depends on transparency, redundancy, accountability, and the ability of the organisation to adapt when disruption occurs.

The extract covers:

• Organisational resilience and governance
• Risk frameworks and governance frameworks
• Organisational design and resilience
• Documented versus operational capability
• Decision-making under stress
• Rational trade-offs and organisational fragility

This extract is taken from the full RiskMasters conversation with Frédéric Gielen discussing organisational resilience, governance, leadership, and the structural choices that determine how organisations perform under pressure. This episode will be released on August 1st 2026.

Compliance is often defined through rules, regulation, and control frameworks.

The challenge is not the absence of rules. It is how those rules are interpreted and applied in practice.

In this RiskMasters bonus episode, Jennifer Geary and Natalie McManus explore the difference between rules-based compliance and principles-based compliance, and why starting with harm leads to better decisions.

The discussion focuses on a shift in sequence.

Compliance processes typically begin with the question: what does the rule require.

In practice, decisions are shaped earlier, when potential outcomes and risks are considered.

Starting with harm changes how compliance operates.

It requires organisations to consider impact before interpretation, and to apply rules in context rather than in isolation.

This creates a shift in how compliance decisions are made:

• decisions are anchored in potential harm rather than rule interpretation
• rules are applied in context rather than followed mechanically
• judgement is exercised earlier in the decision process
• supervision is balanced with trust and capability
• compliance supports outcomes as well as adherence

The extract also highlights the role of supervision.

Organisations can increase control through oversight, automation, and monitoring.

This reduces the risk of error. It also increases cost and can reduce flexibility.

Alternatively, organisations can invest in judgement, enabling individuals to act as their own control.

The balance between supervision and autonomy becomes a risk decision.

For organisations, this changes how compliance supports governance and risk management.

Compliance is not only about meeting regulatory requirements. It is about how those requirements are interpreted, prioritised, and embedded in decision-making.

This includes how harm is identified, how rules are applied in context, and how judgement is developed across the organisation.

Strengthening these capabilities improves how organisations manage compliance risk, support decision-making, and align outcomes with regulatory intent.

This extract is taken from the RiskMasters episode with Jennifer Geary and Natalie McManus, discussing principles-based compliance, decision-making, and the role of the Chief Compliance Officer.

Compliance frameworks typically include risk assessment, monitoring, reporting, governance, and policy.

The challenge is not the absence of these components. It is how they connect in practice.

In this RiskMasters bonus episode, Natalie McManus explains the IMPACT Wheel and how it reframes compliance as a continuous system aligned to the risk management lifecycle.

The discussion focuses on how compliance moves from periodic activity to real-time decision support.

Risk assessment is often treated as an annual or cyclical exercise. In practice, it occurs continuously, whenever new information, regulatory change, or operational risk emerges.

The IMPACT Wheel connects risk identification, measurement, action, monitoring, and correction into a single integrated process.

This creates a shift in how compliance operates:

• risk assessment becomes continuous and real-time
• monitoring reflects current conditions, not predefined plans
• actions are taken based on live information
• issues are surfaced through multiple channels
• insight feeds back into decision-making

The model is designed to be flexible and organisation-agnostic.

It allows compliance, audit, and control functions to operate as a connected system rather than separate activities.

Simplicity is a core principle. Clear models are easier to apply, easier to scale, and more likely to influence behaviour.

For organisations, this changes how compliance supports governance and risk management.

It shifts compliance from a structured framework to an integrated capability embedded in decision-making.

This includes how risk is assessed in context, how monitoring adapts to change, and how information flows across the organisation.

This extract is taken from the RiskMasters episode with Jennifer Geary and Natalie McManus, discussing the IMPACT Wheel, compliance frameworks, and the integration of compliance into the risk management lifecycle.

The Chief Compliance Officer role is often defined through technical expertise, regulatory knowledge, and control frameworks.

In practice, the effectiveness of compliance leadership depends on something broader.

In this RiskMasters extract, Jennifer Geary and Natalie McManus explore how the capabilities required for high-performing Chief Compliance Officers are evolving in response to increasing complexity, data availability, and organisational pressure.

The discussion highlights how compliance is no longer limited to interpreting rules or maintaining frameworks. It is increasingly defined by how leaders apply judgement, influence decisions, and integrate compliance into business operations.

A central theme is the distinction between technical capability and leadership effectiveness.

While data and AI are reshaping compliance functions and enabling new forms of monitoring and insight, they do not determine how compliance performs in practice.

The extract identifies the core capabilities shaping modern compliance leadership:

• the ability to interpret and apply data in context
• the judgement to act under uncertainty
• the influence required to shape decisions across the organisation
• the curiosity to ask better questions
• the empathy needed to build alignment and drive change

This creates a shift in how the Chief Compliance Officer role is understood.

Compliance is no longer a purely technical discipline. It is a leadership function operating at the intersection of governance, risk management, and decision-making.

The discussion also introduces the concept of “flair”.

This reflects the ability to bring compliance to life within the organisation, through how rules are interpreted, how messages are communicated, and how compliance is embedded into day-to-day operations.

For organisations, this has practical implications.

Enterprise risk management, compliance frameworks, and governance structures provide the foundation. The effectiveness of compliance depends on how these are applied in real situations.

This includes:

• how compliance is integrated into decision-making
• how leaders balance technical accuracy with practical judgement
• how influence is exercised across functions
• how ambiguity is managed in complex environments

Strengthening these capabilities improves how organisations anticipate issues, respond to risk, and align compliance with strategic objectives.

This extract is taken from the RiskMasters episode with Jennifer Geary and Natalie McManus, exploring the Chief Compliance Officer role, compliance leadership, and the future of governance and decision-making.

In this RiskMasters episode, Julien Haye speaks with Jennifer Geary and Natalie McManus, co-authors of How to Be a ChiefCompliance Officer.

The conversation explains the Chief Compliance Officerrole as a leadership discipline rather than a control function.

It explores how compliance leadership shapesdecision-making, supports strategy, and embeds culture across the organisation.

Drawing on practical experience, the discussion reframescompliance as a capability that enables sustainable performance, trust, and long-term value.

🧠 What Does a Chief Compliance Officer Do?

A Chief Compliance Officer ensures that an organisationoperates within regulatory expectations while enabling effective decision-making.

The role combines governance, culture, and advisoryinfluence to shape how organisations manage risk, interpret rules, and minimise harm.

In practice, this means embedding compliance into strategy,operations, and everyday decisions rather than applying it after the fact.

🎯 What You’ll Learn

• Why every senior leader operates as a compliance leader inpractice
• How compliance mindset improves escalation and decisionquality
• What defines the Chief Compliance Officer role today
• How compliance leadership creates competitive advantage
• Why most compliance programmes fail to influence decisions
• How the IMPACT Wheel connects compliance into a system

⏱️ Episode Highlights

00:02 – Introduction and framing of the CCO role
00:54 – Compliance as leadership and social purpose
05:34 – Misconceptions about the Chief Compliance Officer
11:55 – Compliance as competitive advantage in practice
26:49 – The IMPACT Wheel explained
41:25 – First 90 days as a Chief Compliance Officer

46:23 – Future capabilities: data, AI, and human judgement

📚 Related Resources

From Approval to Impact: Repositioning Risk Appetite as a Board Tool

Understand how governance frameworks influence real business outcomes

What Would Change if Risk Identification Was Treated as a Strategic Advantage?

Reframe how organisations surface and act on emerging risks

Psychological Safety in Risk Management
Why escalation, culture, and speaking up define effective governance

🎓 Download your CPD certificate:

The CPD Group – Accreditation: #501232

Risk culture plays a central role in operational resilience, particularly in environments shaped by uncertainty and rapid change.

In this segment, Bruce McIndoe explains why governance structures in risk management and crisis management often appear robust but struggle under real conditions.

He highlights how organisations rely on defined roles, escalation paths, and reporting structures, yet face challenges in speed, integration, and decision-making when ambiguity increases.

The discussion explores how culture influences whether early warning signals are surfaced, how oversight shapes behaviour, and how operational resilience depends on the ability to act before information is fully validated.

Listeners will gain insight into:

• How risk culture influences operational resilience and crisis response
• Why governance structures provide confidence but not always effectiveness
• How speed and integration become critical under pressure
• Why oversight can delay escalation when certainty is prioritised
• What this means for enterprise risk management and decision-making

Enterprise risk management, crisis management, and governance frameworks often emphasise structure, reporting, and control.

Operational resilience depends on how organisations behave when conditions are uncertain.

This includes:

• how early signals are surfaced
• how ambiguity is treated in decision-making
• how quickly teams can act across functions

Strengthening these capabilities improves business resilience and response effectiveness.

This extract is taken from the full RiskMasters interview with Bruce McIndoe on operational resilience, risk management, and crisis decision-making.