Risk

Risk is the exposure an institution carries to consequences it has not yet absorbed. It is not a probability exercise. Probability comforts; exposure clarifies. Decision infrastructure treats risk as a structural condition — something that exists in the architecture of commitments, dependencies, and authorities an institution has already built.

The common error is to treat risk as something to be modelled rather than something to be governed. A risk register that no one reads is not governance; it is theatre.

In decision infrastructure

Risk operates as the constraint layer of every decision. Before a decision authority acts, the infrastructure must surface what is at stake — not in abstract terms but in named consequences attached to named owners. Governed risk requires three things: a clear exposure statement, an accountable steward, and a defined escalation threshold.

Decision infrastructure refuses the fiction of "risk appetite" as a single number. Appetite varies by domain, by season, and by the institution's current capacity to absorb loss. The infrastructure must encode these variations rather than flatten them into a corporate tolerance band.

Failure pattern

When risk is absent from governance, institutions mistake comfort for safety. They optimise for the avoidance of visible failure rather than the management of invisible exposure. Decisions cluster around what feels safe rather than what the evidence supports. The institution becomes brittle — stable until the first shock, then catastrophically fragile.

Practical test

For your most consequential current decision, can you name the specific loss you would absorb if it fails — and who has accepted ownership of that exposure?