Risk management as a public relations "on message" exercise?

The request was innocuous and not atypical. Can you help our company develop risk reporting, and put in place a "small risk function" to drive it? Sure, mature risk organizations frame their raison-d'être more broadly, but many successful risk programs have as their genesis a request for better risk reporting.

However, further detail (through an intermediary) was not encouraging. The risk function was to organizationally report to the head of public relations, so as to stay "on message" with stakeholders. Not exactly what a risk professional brought up on a diet of risk management independence, three-lines-of-defense is keen to hear. I nearly declined to initiate discussions, suspecting strongly this might be a perversion of risk management into risk whitewashing instead.

​But, a couple of conversations later, we're reshaping it into something that does make sense. It's a company that has been stuck in deterministic, head-in-the-sand, don't-ask-don't-tell thinking. Stakeholders are getting restless, and when they're not getting good answers to their risk-related questions, supplying their own, less-than-perfect answer. Not clear yet if there is a professional collaboration to be had, but we've progressed to a much more mutually satisfactory conversation about how to pragmatically start having a top-management-and-stakeholders dialogue about risk, not focused on staying "on message" but instead broadening the message. For me as consultant, it's a good lesson in humility. Just because the initial framing of the issues rubbed uncomfortably on some core tenets of risk management as conventionally framed doesn't mean there isn't a meaningful opportunity for better engagement with risk and uncertainty.