Imagine if only a couple months ago you had told colleagues that life as we know it was about to be ransacked by a pandemic. It probably would have elicited little more than the same “I suppose it’s possible” response, as any earlier prognostications of airplanes crashing into buildings, earthquakes causing a tsunami leading to a nuclear catastrophe, or a near-collapse of the global financial system. Had you been certain that such things were about to happen, you might have taken some additional preparation steps, but you didn’t because the near-term likelihood was way too low, and the universe of possible bad things is much too broad. Of course, once the event happens, it’s too late to get ready.

Organizations are witnessing an unprecedented pace of change in their risk exposures, but too many risk management functions haven’t fully adapted. The consequences are profound and often under-recognized. How did this come about, what additional changes are likely, and what can the risk manager do about it? The typical risk management function was formed to manage workplace injuries, public liability claims and motor vehicle accidents, and to oversee an insurance portfolio and related service providers. Beyond a couple of core functions, the staff is typically too small for meaningful specialization. Technology tools are oriented toward recording, summarizing and analyzing claims in a relative handful of loss categories. Reactive activity is the norm despite wishes to the contrary. On most days the staff goes home frustrated, wishing they had more organizational influence and more time to pursue difference-making initiatives.