It may be assessing the exposure, monitoring it, reporting it and chasing actions. It does not control pricing, underwriting, distribution or commercial negotiation. Yet organizations routinely create what I would call administrative ownership. A name appears against the item. An action has an owner. A due date is entered. The spreadsheet is satisfied. The exposure may be less impressed.

Everything can be in place. The CRO reports to the board. The risk committee meets quarterly. The register is current, the appetite statement was approved last year, and the dashboard is green. And the company still walks into the exposure it had been watching.

Part I ended with Cassandra’s curse: the warning exists, but the decision proceeds much as it would have without it. The harder question is why. In practice, the answer often lies in how risk management is positioned, when the risk function becomes involved, and whether management is still genuinely open to changing course.

Some years ago, a sizeable life insurer was acquired by a banking group. A new senior management team arrived and asked each function head to explain what, exactly, their team contributed.