A board should oversee strategy and risk as one connected responsibility: approve the direction, test its assumptions, define acceptable exposure, monitor leading indicators and require management to act when conditions change. The board should not run daily operations. Its job is to make sure management’s strategy is credible, risks are understood and decisions remain within agreed boundaries.
The practical test is simple. Directors should be able to explain what must go right, what could materially change the outcome, how much exposure the organization accepts and what evidence would trigger a different decision.
“Most organizations do not fail because of strategy. They fail because execution becomes fragmented, accountability becomes unclear, and critical decisions arrive too late. Strong governance creates the discipline that transforms plans into measurable business results.”
Mehrzad Verdizadegan, PhD
CEO, Praevion Consulting Inc.
How should a board connect strategy and risk?
Every strategic choice creates exposure. Entering a market may create customer concentration, regulatory and capital risks. Automation may improve productivity while increasing cyber, data and workforce risks. The board should discuss the expected return and the conditions that could prevent it in the same conversation.
The G20/OECD Principles of Corporate Governance 2023 join these responsibilities explicitly: boards review strategy and major plans, set performance objectives, assess risk policies and determine risk appetite. For an SME, this can be expressed in one page that lists the strategic objective, key assumptions, material risks, tolerances, indicators and accountable executive.
What belongs to the board and what belongs to management?
| Board oversight | Management responsibility |
|---|---|
| Approve strategy, major capital commitments and risk appetite | Develop options, recommend a plan and execute it |
| Test assumptions, alternatives and downside exposure | Identify, assess, treat and report risks |
| Monitor performance, resilience and control effectiveness | Operate controls and escalate exceptions |
| Change direction or leadership when evidence requires it | Correct performance within delegated authority |
This boundary preserves challenge without turning directors into a second management team. A peer-reviewed review of 150 studies found that board contribution to strategy depends on composition, processes, dynamics and context. Formal independence alone does not create useful strategic involvement.
What questions should directors ask?
- Choice: What problem are we solving, and what are we choosing not to do?
- Evidence: Which assumptions are facts, estimates or management judgments?
- Exposure: What could cause material financial, operational, legal or reputational harm?
- Capacity: Do we have the cash, people, systems and leadership attention to execute?
- Alternatives: What lower-risk or staged option was rejected, and why?
- Triggers: Which indicator would cause us to pause, accelerate or exit?
Challenge should improve the decision, not reward directors for finding fault. The chair should draw out dissent, test whether contrary evidence was considered and close with a precise decision, conditions and review date.
What should a strategy and risk dashboard contain?
A board pack should lead with decisions and exceptions, not operational detail. Each strategic priority needs a small set of forward-looking and outcome measures.
| Information | Board use |
|---|---|
| Objective and accountable executive | Clarifies ownership |
| Milestone, benefit and cash position | Tests progress and affordability |
| Top risks, trend and tolerance | Shows changing exposure |
| Control or response status | Tests whether treatment is working |
| Decision or escalation required | Focuses meeting time |
ISO 31000:2018 provides a principles, framework and process approach that organizations of any size can adapt. It is guidance, not a certifiable standard. Its emphasis on integrating risk into decisions is more useful than maintaining a risk register that is separate from strategy.
How often should the board review strategy and risk?
Approve the strategic plan annually, but review strategic assumptions and material risks at every regular meeting. Deep dives can rotate by priority. A trigger-based escalation rule should bring an issue forward immediately when exposure exceeds tolerance, a critical assumption fails or a major opportunity appears.
Minutes should record the information considered, material challenge, decision, conditions and follow-up. They should not become a transcript. The board should also meet periodically without management so directors can discuss leadership, information quality and unresolved concerns.
What is the Canadian governance context?
For federally incorporated companies, section 102 of the Canada Business Corporations Act assigns directors responsibility to manage or supervise management. Section 122 requires directors and officers to act honestly and in good faith in the corporation’s best interests and exercise reasonable care, diligence and skill. Provincial statutes and sector rules may differ.
Canadian National Policy 58-201 applies to reporting issuers, not private SMEs generally. It is still a useful benchmark: the board mandate covers annual strategy approval, business opportunities and risks, principal risks, risk-management systems and management information. Private companies should scale the practice, not assume the policy is a legal requirement for them.
How can a board improve oversight in 90 days?
Praevion’s management consulting work follows Discover, Design, Deliver and Transfer.
- Discover: Map decisions, current reporting, strategic assumptions, major risks and recurring surprises.
- Design: Define reserved matters, risk appetite, indicators, escalation thresholds and the board calendar.
- Deliver: Test the approach on one material strategic decision and two board meetings.
- Transfer: Train directors and executives, assign owners and hand over templates and review routines.
Praevion’s PMO and Governance Transformation case study reports improved visibility, resource allocation, accountability and execution consistency for an anonymous client. Those are company-reported qualitative outcomes, not quantified universal results.
Which measures show that board oversight works?
- Share of strategic decisions supported by options, assumptions and downside analysis
- Material risk exceptions escalated within the agreed time
- Strategic milestones achieved without breaching approved tolerance
- Actions closed by the named owner and review date
- Board time devoted to forward-looking strategy and risk rather than routine reporting
Review these measures quarterly and change the process when the evidence shows weak challenge, late information or repeated surprises. For support, contact Praevion Consulting Inc.
Frequently asked questions
Should the board approve every risk?
No. The board approves the risk appetite, material exposures and exceptions. Management handles risks within delegated authority and escalates when a threshold is crossed.
Does a small company need a separate risk committee?
Usually not. The full board can oversee risk if the agenda, skills and information are adequate. A committee becomes useful when regulation, complexity or workload requires deeper attention.
Who owns strategy, the board or the CEO?
Management develops and executes strategy. The board challenges and approves it, monitors results and changes direction or leadership when evidence warrants action.
References
- Department of Justice Canada. Canada Business Corporations Act, section 102, current to 21 July 2026.
- Department of Justice Canada. Canada Business Corporations Act, section 122, current to 21 July 2026.
- Canadian Securities Administrators. National Policy 58-201 Corporate Governance Guidelines, effective 30 June 2005.
- OECD. G20/OECD Principles of Corporate Governance 2023. OECD Publishing, 2023.
- International Organization for Standardization. ISO 31000:2018 Risk management: Guidelines, 2018.
- Pugliese, A. et al. Boards of Directors’ Contribution to Strategy: A Literature Review and Research Agenda. Corporate Governance: An International Review, 17(3), 292–306, 2009.
