How Risk Committees are Redefining Board Agendas.

Risk committees are moving from oversight functions into strategic partners, helping organisations forecast disruption, shape decision-making and build resilience.

“Risk governance is becoming both more dynamic and more deeply embedded across organisations,” says Cihan Elbirlik, Chair of a globally integrated industrial group. “Risk is no longer viewed as a static inventory, but as a continuously evolving system requiring constant recalibration.”

This shift reflects a broader reality of the ‘polycrisis’ companies are facing. The recent research report by Odgers Türkiye highlights that geopolitical volatility, macroeconomic instability, climate disruption, technological acceleration and socio-economic fragility are deeply interconnected.

Risk operates as “a networked system where shocks propagate across domains … in which anticipation becomes more important than prediction, and prevention becomes more valuable than reaction,” says Cansen Başaran-Symes, Chair of Allianz Türkiye.

In this environment, risk committees are not simply being asked to identify threats, but to help boards anticipate change and inform strategy.

As Mehmet Abbasoğlu, CEO of Petrol Ofisi Group notes, a crisis such as over the Strait of Hormuz, can “cascade across supply chains, pricing mechanisms, and financial systems within hours rather than days.” The critical differentiator, according to Gür Çağdaş, Vice Chair of a diversified conglomerate who heads its Risk Committee, “is the organisation’s ability to translate real-time risk insights into timely and high-quality decisions.”

The new risk landscape

This reframing of risk is particularly apparent in the financial sector where digital payments, open banking, AI-enabled services, and platform-based ecosystems, risks such as cyberattacks, fraud, data integrity threats, and third-party vulnerabilities arise at the same pace as growth itself.

According to Yasemin Bedir, Division President for Eastern Europe, Middle East and Africa at Mastercard, managing such risks requires “continuously adaptive, ecosystem-wide resilience models supported by real-time intelligence and cross-sector collaboration.”

While leading organisations are increasingly adopting enterprise-wide approaches to risk, many companies across the Middle East continue to assess risks individually rather than as interconnected challenges. One director we spoke to in the region argued that businesses “need a broader, deeper approach.”

As organisations become larger, more international and more exposed to geopolitical and technological disruption, boards are beginning to recognise the need for a broader and more integrated view of risk.

The strategic perspective

How risk analysis is positioned within a company says a lot about approach to strategy. “Risk management must be structurally embedded within strategic planning architectures, anchored in reliable data systems, and operationalised through coordinated decision-making flows across the organisation” says Çağdaş. “Risk is not reviewed after strategy is formed; it is embedded into how strategy is constructed in the first place.”

For boards, this evolution has practical implications:

Risk committee agendas are expanding beyond financial controls and regulatory compliance.
Agendas now need to include cyber resilience, AI governance, geopolitical disruption, talent risk and organisational adaptability.
The discussion is becoming less about reviewing historic risks and more about testing future scenarios and strategic choices.

Outside financial services, dedicated risk committees remain relatively uncommon across parts of the Middle East, with responsibility for risk oversight often sitting within governance, compliance, internal audit or finance functions. However, larger organisations and government-backed transformation programmes are increasingly treating risk as a strategic capability rather than a reporting requirement.

Risk is now “increasingly recognised as a direct driver of long-term value creation,” says Serdar Çaloğlu, a former CEO now serving on numerous boards.

The role of risk committees is changing from monitoring exposure to informing key decisions.

This approach is echoed in South Africa where risk, under the King IV governance framework, is not treated as an isolated control function, but as an integral component of strategy, performance and sustainable development.

Risk is deemed inseparable from long-term value and risk committees have a forward-looking, strategic role.

A non-executive director (NED) based in South Africa noted their effectiveness is underpinned by independence, diversity of perspective and depth of technical, regulatory and operational expertise to challenge constructively in strategic debates.

In digital and platform-driven sectors, sustainable growth – and therefore valuations – depends on trust, security and resilience engineered into system design from the outset. It’s a “foundational enabler of scalable growth”, added Bedir. It’s about determining risk appetite early on. This might include decisions around early divestment from exposed regions and sectors, pre-emptive supply chain diversification and ESG positioning, notes Çağdaş.

Emerging governance challenges

The key lies in developing systems that distinguish between transient market noise and structural shifts. That’s becoming harder but more essential as the risk landscape itself broadens. Threats can arise anywhere: for example, access to materials, supply chain continuity, financing conditions, reputational exposure and increasingly cyber security and data integrity. Even localised disruptions can quickly ripple out to affect prices, inflation, trade flows and broader socio-economic stability, making risk inherently systemic rather than segmented and requiring the board’s strategic attention.

The challenge is magnified by technological change. “The primary risk is not technological, but organisational,” says Murat Yıldıran, an advisory board member and former CEO and Chair. As AI moves from analytical support into decision-making, transactions and customer interactions, boards face a new category of governance risk. The question increasingly becomes less about the technology itself and more about whether organisations have the leadership, processes and oversight required to deploy it responsibly.

Abbasoğlu describes the challenge as “polyperspectivity” i.e. the ability to integrate multiple lenses simultaneously across strategy, operations, finance, geopolitics and human capability.

Why resilience is still a human capability

Despite advances in data analytics and predictive technologies, effective risk management remains fundamentally human. Risks are interpreted, prioritised and acted upon by people, making leadership judgment, communication and organisational culture critical determinants of resilience.

Much depends on how risk is communicated. Some companies struggle to find a risk officer who can present clearly to a board of non-risk experts based on factual, measurable and accurate data, says a NED at a Dubai-based bank. “Asymmetry risk exists between part-time generalist overseers and full-time expert operators” but this is changing. It’s “half-way between west and east.”

Board-CFO interactions, for example, have had to become more frequent and of higher quality. CFOs become active interpreters of risk and co-architects of strategic response alongside boards. It should not stop there. All levels must be involved so that “shared situational awareness becomes a core organisational capability rather than an informal outcome,” says Cansen Başaran-Symes.

Talent strategy must also be integrated into board-level discussions of risk. The human ability to respond well has become a defining factor of organisational resilience. It encompasses leadership continuity, employee engagement and organisational adaptability, continuously learning and relearning.

As risk committees grow increasingly central to board effectiveness, appointing the right Chair has become a critical governance decision. Beyond technical risk expertise, boards require leaders who can connect emerging risks to strategic choices, facilitate constructive challenge and ensure risk insights result in action. In a world where foresight becomes as important as oversight, the quality of the risk committee leadership may prove a defining factor in organisational resilience and sustainable value creation.