Beyond the risk register: exploring hidden risks in an uncertain world

Burness Paull’s Disputes Group recently hosted its annual Risk Conference. This year we sought to explore the simple yet challenging question: what are the risks that organisations should be talking about more?

Most organisations have well-developed risk registers and governance processes. Yet the events that cause the greatest disruption are often those that sit outside conventional planning. 

Our panel of business leaders: Chris Tiso – CEO – Tiso Group, Sam Cooper-Gray – Founder – Women are Good Business, Carolyn Thurston Smith – Senior Legal Counsel – Fidra Energy and Roddy MacDougall – Head of Legal – Network Rail, explored some of the risks that boards may not be discussing enough and what businesses can do to improve resilience.

Risk and opportunity go hand in hand

Opening the conference, Chris Tiso reflected on the “anatomy of risk”. Drawing on his experience in business and leadership, he argued that risk is fundamental to growth and progress.

The challenge is not eliminating risk entirely but understanding and managing it. Organisations that become too risk-averse may ultimately expose themselves to the danger of not being able to move forward. Risk should not be irrationally feared, but rather responsibly embraced. 

Against that background, we explored some of the risks that our panel felt warranted further board attention.

The challenge of AI governance

AI featured prominently throughout the discussion. While many organisations have embraced AI tools, governance frameworks often lag behind adoption. Our panellists highlighted concerns around data security, ownership of AI risk, the rise of AI-generated complaints and correspondence, and the potential loss of critical skills through over-reliance on automation. 

The consensus was clear: boards do not need all the answers, but they do need to be asking the right questions around how their organisations are utilising AI. The greatest risk may not be the technology itself, but rather the failure to maintain control over its use.

Hidden dependencies and concentration risk

Efficiency has brought significant benefits to businesses and other organisations but has also created new vulnerabilities. From supply chains to digital infrastructure, many organisations rely on a small number of providers, products or systems. These dependencies often remain hidden until something goes (often catastrophically) wrong.

Our discussion reinforced the importance of understanding not only direct suppliers, but also the wider ecosystem that supports critical operations. Resilience may come at a cost, but businesses increasingly need to balance efficiency with preparedness.

Climate adaptation deserves more attention

While climate discussions often focus on sustainability and net zero ambitions, the panel argued that adaptation deserves equal attention. Organisations must consider how physical climate impacts, from severe weather to infrastructure disruption, could affect operations and long-term strategy. Climate adaptation should therefore be embedded in business planning, not simply an immediate compliance exercise.

Risks rarely arrive alone

One of the strongest themes to emerge during the conference was the importance of understanding how risks interact with each other.

Major business crises are rarely caused by a single issue. A cyber incident, for example, can quickly trigger regulatory, operational, reputational and legal challenges simultaneously.

Boards should therefore spend more time considering compound risks and stress-testing how different threats can combine and escalate.

Diversity of thought as a risk tool

When discussing how organisations can identify the “unknown unknowns”, our panellists consistently returned to one factor: diversity of thought.

Businesses and other organisations need people who challenge assumptions, bring different perspectives and ask uncomfortable questions. Strong governance is not about achieving consensus at all costs. It is about ensuring that blind spots are identified before they become problems.

Preparing while there is still time

The conference concluded with a simple message: 

Resilience is not about predicting every risk. It is about understanding how risks connect, recognising hidden dependencies, considering consequences, embracing informed risk-taking and ensuring the right people are around the table to challenge assumptions.

The objective is not to foresee every future disruption by eliminating all risk. It is to ensure that organisations are prepared to respond when uncertainty arrives.

“it is important to prepare while we still have choices”

At Burness Paull, our Disputes and Regulatory team help organisations identify emerging risks, strengthen governance and resilience frameworks, and navigate complex crises when they occur. Whether the issue is AI governance, supply chain vulnerabilities, climate adaptation or managing the fallout from a major incident, our multidisciplinary approach helps clients anticipate challenges and respond with confidence.

Our market-leading Disputes Group brings together experts in contentious matters from the firm’s commercial litigation, health and safety, corporate crime, employment, construction and projects, public law & regulatory, planning and environment, and family law teams.

Related News, Insights & Events