Risk management: Major programmes are losing sight of corporate strategy

DORA, NIS2, cyber requirements, documentation, governance and reporting. In many companies, regulatory programmes are now growing faster than the businesses around them.

They often begin with forces outside the organisation. New regulatory requirements, cyber threats or expectations from customers and authorities prompt management to act. The result is often a multimillion-pound programme intended to strengthen cyber security, protect data, meet new requirements and reduce critical supply chain dependencies.

But something happens along the way.

As with many major programmes, new requirements, dependencies and stakeholders are continually added. The scope expands. Governance grows. More reports, meetings and controls find their way into the programme. Gradually, the focus shifts from the original problem to the programme itself.

Suddenly, the organisation is devoting vast resources to activities whose connection to the original strategy has become unclear.

We see this across sectors. Energy companies establish major transformation initiatives in response to green regulation, only for them to become so complex that ownership within the organisation gradually disappears. Banks, pharmaceutical companies and defence businesses create regulatory programmes that evolve into parallel organisations alongside the day-to-day business and gradually lose their connection to commercial strategy. They take on a life of their own.

The common denominator is the same: the link between the original ambition and day-to-day execution gradually weakens. No one dares to stop the programme. No one dares to scale it back. No one wants to be responsible for closing an initiative that has already cost millions and involved large parts of the organisation.

Many programmes are launched with clear ambitions, but without clear measures of success, defined criteria for when the programme can be concluded or an ongoing assessment of whether it is still creating value.

As a result, many programmes simply continue. More governance. More deliverables. More status meetings. More layers of coordination.

Perhaps we should instead make it a mark of success to close a programme at the right time: to demonstrate that its objective has been achieved, its value realised and its resources released for new strategic priorities. Or to recognise that the underlying assumptions have changed so significantly that the programme no longer creates enough value to justify the investment.

When programmes continue without an ongoing assessment of their relevance, it becomes increasingly difficult to answer the most fundamental question: what specific problem are we trying to solve?

That question is often drowned out as the focus shifts from impact to activity. From business to process. The consequences extend far beyond the teams working directly with regulation and control. Major programmes tie up specialists, management attention, technology investment and organisational energy. They affect priorities across the entire business.

When the link between strategy and execution weakens, the company also loses its ability to prioritise effectively.

The result is organisations spending vast sums to keep complex programmes alive without being able to explain how their activities support corporate strategy or contribute to the outcomes the programme was originally intended to deliver.

And this is precisely where the paradox arises. Many companies have never invested more in governance, documentation and control. Yet they are gradually losing the link between strategy and execution. The answer is not more governance. It is leadership teams willing to stop activities, scale programmes back and reconnect them with corporate strategy on an ongoing basis.

Because when the link between strategy and execution disappears, programmes often continue under their own momentum. And then it becomes difficult to answer the question that should matter most of all:

Why are we still doing this?

Read the article in Finans in Danish.