A Risk Register Cannot See the Whole System

A governing body receives assurance from every part of an institutional group. Each subsidiary has a risk register. Each department has named owners. Each programme reports its controls. Yet several units depend upon the same supplier, the same specialist, the same data source and the same emergency finance. A disruption in one place will therefore travel through the system, but no individual register shows the full route.

The problem is not always neglect. It is often perspective. A capable manager can govern the risks inside one unit while remaining unable to see concentration across the whole portfolio. Separate green reports can combine into one red institutional reality when liabilities, infrastructure, reputation, technology and public obligations are shared.

A risk register cannot see the whole system. Responsible leadership preserves local accountability while creating a portfolio view of interdependence, cumulative exposure and opportunity. It uses that view to make decisions about capital, capability, continuity, partnership, service and correction before a hidden connection becomes a common failure.

On 15 September 2026, the OECD published Managing Risk Across State-Owned Enterprises. The 86-page report examines how state owners can move beyond fragmented enterprise-level oversight and understand financial, operational, sustainability, corruption and integrity risks across an entire portfolio. It draws on a qualitative survey, interviews, international standards and six country case studies.

The report's clearest finding is a gap between local…