“What keeps you up at night?” is a familiar opening for an executive risk workshop. It can also send the meeting straight toward a familiar list: cybersecurity, talent, supply chain, competition. Everyone contributes, the group votes, and someone updates the heat map.
But what changed because the group met?
A useful workshop should help leaders test assumptions, understand consequences and decide what to do next. Here’s a practical way to structure a 90-minute session.
1. Get individual input before the meeting
Give participants the same business objective and time horizon. Ask each person to spend 15–20 minutes preparing up to three scenarios independently. “Supply chain” is a category. A scenario describes what could happen, how it would affect the business and what might make recovery difficult.
Consolidate the input into eight to twelve draft scenarios. Keep meaningful differences in assumptions visible. Those differences are often where the useful discussion starts.
2. Decide what the meeting needs to accomplish
Before sending the invitation, identify what leadership should be able to decide by the end. Do you need to validate an assumption, change a response, allocate resources or escalate an exposure? Invite people who understand the plan and have the authority to act on it.
If the issue is technical and the evidence sits with two or three people, a smaller working session may be more useful.
3. Use a time-boxed agenda
Here’s the agenda in my workshop playbook:
- 0–10 minutes: Agree on the objective, time horizon and decision authority
- 10–25 minutes: Review the prepared scenarios and identify omissions
- 25–50 minutes: Trace the priority scenarios through the business
- 50–70 minutes: Challenge exposure, controls, response capacity and evidence
- 70–85 minutes: Assign owners, actions, due dates and escalation thresholds
- 85–90 minutes: Read back decisions and unresolved disagreements
You won’t examine every risk in detail in 90 minutes. Pick the few that need the group’s attention.
4. Follow the consequences and test the evidence
For each priority scenario, ask:
- What starts the disruption?
- How does it affect other functions or commitments?
- What prevents recovery or substitution?
- What happens to revenue, cash or the strategic objective?
Separate the exposure estimate from your confidence in it. A recovery plan may depend on supplier capacity, a backup that hasn’t been tested or an approval that’s still pending. Write those conditions down. A proposed response shouldn’t be reported as a verified reduction in exposure. When leaders disagree, capture the assumptions behind each view and assign someone to get the missing evidence.
5. Protect the closing twenty minutes
Don’t let a debate about scores consume the time needed to agree on action. Each priority risk needs one accountable owner with the authority to coordinate the response. Record the next action, what completion looks like, the due date and the specific condition that triggers escalation. Send a short decision record within one business day, including unresolved questions and who will close them.
The final check is simple: what changed because the group met?
I put together a free eight-page playbook with a participant invitation, facilitation prompts, scenario and decision worksheets, and a completed example. There’s an editable Word version and a PDF, with no email required:
https://kennedyriskgroup.com/blog/enterprise-risk-workshop
What’s hardest to get right in your workshops: getting independent input, challenging assumptions or agreeing who owns the next step?
Comments