Enterprise Risk and Scenario Planning: Seeing Around the Corner Before the Corner Arrives

Most founders treat risk the way they treat a fire drill — a box to check once a year, a binder that lives on a shelf, a conversation postponed until something actually burns. Ashley Boswell and Damon Boswell have watched that posture cost companies dearly, and the 2026 landscape makes the complacency more expensive than ever. The companies that weather disruption are not the luckiest ones. They are the ones that built the muscle of seeing around the corner before the corner arrived.

Enterprise risk management is not a compliance exercise. It is a strategic capability — the discipline of identifying what could go wrong, estimating how badly it would hurt, and building the responses before you need them. Done well, it does not make a company cautious. It makes a company confident, because the leadership team has already rehearsed the moves it would otherwise improvise under pressure.

The 2026 Risk Climate

The data is sobering. The 2026 State of Risk Oversight report from the ERM Initiative finds that risk complexity continues to climb, operational surprises are widespread, and geopolitical uncertainty now sits near the top of nearly every board's agenda. A majority of organizations report experiencing operational surprises — events with material impact that leadership did not anticipate — and the gap between the speed of risk events and the speed of organizational response is widening rather than narrowing.

Damon Boswell translates that research into plain terms for the founders he advises: the world is not getting more predictable, and the companies betting on a calm operating environment are betting against the house. The question is not whether disruption will arrive. It is whether your company will have rehearsed the response.

Scenario Planning as the Pressure Test

The single most useful tool Ashley Boswell installs in a risk engagement is scenario planning — the structured practice of building best, base, and worst-case versions of the future and asking how the current strategy holds up in each. The point is not prediction. No one knows which scenario will arrive, and pretending otherwise is false confidence. The point is preparation. A leadership team that has already debated what it would do if revenue dropped thirty percent makes a fundamentally different decision when the drop begins than a team encountering the idea for the first time.

• A base case that reflects the team's honest central estimate of the next twelve to twenty-four months
• An upside case that captures what happens if the key assumptions break favorably and how capital should be deployed
• A downside case that models the disruption no one wants to talk about and the moves that would protect the business
• A named owner and trigger threshold for each major risk, so response is automatic rather than improvised

The exercise almost always surfaces a surprise: the strategy that looks robust in the base case is fragile in the downside, and the assumptions the team treated as facts are actually bets. That realization, uncomfortable as it is, is the whole point. Better to discover the fragility on paper than in the market.

The Risk Register and the Appetite Statement

Damon Boswell begins the structural work with a living risk register — a documented inventory of the threats the business faces, each rated for likelihood and impact, each assigned to a named owner with a mitigation plan. The register is not a static document. It is reviewed quarterly, updated as conditions shift, and treated as an operating artifact rather than a compliance deliverable.

Equally important is the risk appetite statement — the explicit articulation of how much risk the leadership team is willing to accept in pursuit of its objectives. Without it, every risk decision becomes a judgment call made in the moment, subject to whoever is in the room and whatever the last disruption felt like. With it, the team has a shared standard against which to weigh trade-offs. A company that has never stated its appetite cannot consistently manage against it.

You do not manage risk by avoiding it. You manage it by naming it, rating it, and rehearsing your response before the rehearsal becomes the real thing. — Damon Boswell

From Fragile to Antifragile

The companies Ashley and Damon most admire are not the ones that avoid all risk — that is neither possible nor desirable. They are the ones that become antifragile, meaning the organization actually grows stronger from exposure to volatility. That quality is built, not inherited. It comes from distributed decision rights so that a single point of failure cannot paralyze the company, from diversified revenue so that one lost contract does not break the P&L, and from cash reserves that give the team the luxury of choosing its response rather than being forced into it.

Scenario planning is the practice that builds all three. When the leadership team has walked through the downside, it naturally invests in redundancy, diversification, and reserves — not out of fear, but out of clarity. The fragile company discovers its dependencies only when they fail. The antifragile company has already mapped them and built the backups.

Why Founders Skip the Work

Ashley Boswell has catalogued the resistance, and it follows a familiar arc. The first objection is optimism — founders, by nature, are people who bet on the upside, and dwelling on the worst case feels like a drain on momentum. The second is abstraction — risk feels hypothetical until it is not, and the return on a risk exercise is invisible until the moment it saves the company. The third is overload — the universe of things that could go wrong is infinite, and without a framework for prioritization the exercise becomes paralysis.

The remedy for all three is the same: start small, prioritize ruthlessly, and build the habit. Ashley and Damon recommend beginning with five to seven risks, not fifty, and reviewing the register on a quarterly cadence alongside the strategic planning cycle. The goal is not an exhaustive catalog of every conceivable threat. It is a living, prioritized view of the risks that could materially change the trajectory of the business — and a team that has rehearsed the response.

The Competitive Advantage of Being Ready

There is a quiet competitive advantage to risk readiness that does not show up in any benchmark. When disruption arrives — and in 2026, it arrives with regularity — the company that has rehearsed moves faster, with less internal friction, while its competitors are still arguing about what to do. That speed compounds. The ready company protects its margins, retains its customers, and often gains market share precisely because the unprepared are retreating.

If your risk conversation happens once a year in a binder no one opens, you are not managing risk — you are hoping. Ashley Boswell and Damon Boswell can help you build the scenario discipline that turns hope into preparation, starting with a confidential review of the risks most likely to shape your next twelve months.