Once a quarter, in offices across the South West, a familiar document appears on the screen. The risk register. Rows of risks, each with a likelihood, an impact, a colour and an owner. The meeting works down the list, nods at the reds, notes that the ambers are being monitored, and moves on. The document is thorough. It is also, quietly, ignored. Everyone in the room could name their top risks. Almost nobody has ever felt what it would be like for one of them to actually happen.
That gap, between knowing a risk and understanding it, is where most risk management quietly fails.
Knowing a risk is not the same as understanding it
A logged risk is a sentence. “Loss of a key supplier.” “A serious cyber incident.” “A senior departure at the worst possible moment.” The sentence records that the risk exists. It records almost nothing about what the risk would do: how the information would arrive late and incomplete, which decision would fall to whom, what the second and third consequences would be, and how the team would behave while the clock ran.
Understanding a risk means having reasoned all the way through it, ideally having lived a version of it, so the team recognises its shape early and knows roughly how it means to respond. A register entry gives you a label and a comforting sense of having dealt with the matter. It does not give you that.
Risk management has become a process, not a capability
In many organisations, risk management has been quietly stovepiped. It belongs to a function, lives in a document, and is reviewed on a cycle, running alongside the real decisions of the business rather than informing them. The register is updated, the box is ticked, and the capability that actually matters, the team’s ability to respond well when a risk crystallises, is never built or tested.
A risk register is a useful input. It is not the same thing as risk management, in the way that a list of ingredients is not a meal. The register tells you what to worry about. It does nothing on its own to develop the judgement, the shared picture and the rehearsed responses that decide how well you cope when one of its rows comes true.
Decision making scenarios turn a register entry into understanding
A decision making scenario takes a risk off the register and lets the team live through it. The format can be a tabletop exercise, a scenario based game, or a more immersive simulation, depending on the stretch required. The situation unfolds with incomplete information, competing pressures and a clock that does not stop, and the team has to make the calls the risk would really force on them.
What changes in that room is the quality of attention. A risk that read as a single orange line arrives as a sequence of awkward, specific problems: the customer who needs an answer before you have one, the regulator who has to be told, the decision with no good options. The team stops describing the risk and starts contending with it.
This is where the difference between a decision and a dilemma becomes real. A decision is a choice between options that have genuine merit. A dilemma is a choice between options that all carry a cost, where the right answer is the least bad one. Risks, when they crystallise, tend to produce dilemmas, and a team that has only met its risks as register entries has never practised choosing the least bad option under pressure. A scenario gives them that practice while it still costs nothing.
Rehearsal builds the habit
The value is not the single dramatic afternoon. It is repetition. The first scenario is hard work, because the team is meeting the situation and the discipline of working through it at the same time. By the third or fourth, the alarm of novelty has gone, and the team reads a developing situation more calmly because its shape is already familiar.
This is what turns contingency planning from a paper exercise into resilience. A fallback position that has been rehearsed is one the team can actually execute, and a plan pushed until it broke and then rebuilt holds together on the day in a way an untested one never does. Crisis communication, so often the part that turns a manageable problem into a reputational one, is rehearsed in the same room rather than improvised in the moment.
What this looks like for Dorset business
The strongest exercises are built around the risks an organisation actually carries, not a generic catalogue. The scenarios are drawn from its own register, its own market and its own dependencies, so the decisions in the room are the ones its leaders would genuinely face.
Local businesses are well served for this. Evocatus is based at Dorset Innovation Park, within easy reach of Bournemouth, Dorchester and the wider South West, and designs bespoke decision making scenarios, tabletop exercises and scenario based games for teams that need to manage real risk rather than merely record it.
Return to that quarterly meeting and the register on the screen. A team that has scenario-tested its top risks reads it differently. The rows are no longer abstractions to be noted and monitored; they are situations the team has already lived through once, in a room where it was safe to get it wrong. That is the difference between a risk register and risk management.
Why Evocatus
Evocatus Consulting designs and delivers decision making scenarios, tabletop exercises and scenario based games that help leadership teams understand and manage the risks they actually carry. We draw the scenarios from your own risks, surface the dilemmas your team will face, and rehearse the decisions and the communication together, so the response is practised rather than improvised. That is what organisational resilience means in practice: not a document, but a capability. Dorset-based organisations are within easy reach of our base at Dorset Innovation Park.
If you would like to discuss what bespoke risk management support could do for your team, please get in touch.