In this episode of Risk Is Our Business, Captain Michael Rasmussen is joined by Chyono Flynn, Head of Enterprise Risk Management at Rolls-Royce, for a candid conversation about the realities of running risk management inside one of the world’s most complex engineering organizations.

They begin with what really keeps risk leaders awake at 2 a.m., which is not abstract frameworks, but execution risk, governance expectations, and whether the organization truly understands its most critical exposures. From there, the discussion moves into the UK Corporate Governance Code, with particular focus on Provision 29, and what it means in practice for boards, executives, and risk teams responsible for viability and long-term resilience.

Chyono and Michael draw clear distinctions between bad risk management  (compliance-driven, disconnected, and report-heavy) and good risk management that engages the business, informs decisions, and earns trust at the executive and board level. They explore how to communicate the value of risk in a way that resonates, how to build and sustain a healthy risk culture, and why partnership matters more than policing.

They also discuss the role of technology as an enabler rather than a solution in itself, and how tools must support judgement, insight, and dialogue rather than replace them.

This episode offers a grounded look at what enterprise risk management looks like when governance expectations are high, stakes are real, and risk must help the organization stay on course, even when the pressure is on and sleep is in short supply.