Executives rarely struggle to understand risk. They struggle to act on the way it is given to them.
Early in my career, I believed that if I explained a risk thoroughly enough, the right decision would follow on its own.
I would lay out the full picture. The technical detail, the conditions under which the problem could occur, the mitigations in place, the residual concerns and the things we still didn't know. Completeness felt like the responsible thing to do. If I knew something that might matter, I felt an obligation to put it in the room.
It often didn't work the way I expected.
I would finish what I thought was a careful explanation and watch the discussion drift. Questions would come back that seemed surprisingly basic given everything I had just covered. Sometimes people would focus on a detail I considered secondary. On other occasions, the decision would simply be deferred because nobody felt quite ready to make it, despite having been given a great deal of information.
At the time, I found that frustrating.
Looking back, I can see that I was confusing two different responsibilities.
I understood the risk. I had explained the risk accurately. What I hadn't necessarily done was make it usable for the people who had to decide what to do about it.
That distinction took me longer to understand than I would like to admit.
As testing leaders, we spend much of our careers learning to notice complexity. We are trained, formally or otherwise, to look for conditions, dependencies, exceptions and uncertainty. We know that apparently simple problems often have something more complicated underneath them, and experience teaches us to be suspicious of explanations that are too neat.
Those instincts are valuable.
But they can also shape the way we communicate.
Because we arrived at our understanding by working through the detail, we often reproduce that journey for everybody else. We start with the mechanism, move through the evidence, explain the qualifications and eventually arrive at the consequence.
By then, the person listening may still be trying to work out why any of it matters to the decision in front of them.
I don't think that is an executive's failure to understand risk.
More often, it is our failure to recognise that they are approaching the same information from a different direction.
A testing leader is usually trying to understand what is happening. An executive is more likely to be trying to understand what this means for the decision I am accountable for.
The same risk looks different from those two positions.
Once I began to appreciate that, I changed the order in which I talked about risk.
I started with the consequence.
Not because the mechanism had become less important, but because the consequence gave everything else somewhere to land. If the room understood what could happen, who or what could be affected and why it mattered, the supporting detail suddenly had context.
That sounds obvious to me now. It wasn't obvious to me then.
There is a natural temptation, particularly when speaking to senior people, to demonstrate that you have done the work. You know how complicated the issue is, and some part of you wants the room to understand that complexity too. The detail becomes evidence of diligence.
Sometimes it is.
But I have also learned that technical completeness and executive usefulness are not the same thing.
That was a difficult adjustment because leaving information out initially felt uncomfortable. If I had twelve relevant facts and presented four, was I simplifying the position or concealing part of it?
The answer depends entirely on which eight facts were left behind.
There is a significant difference between removing information because it complicates the decision and removing information because it does not materially change it. The first is dangerous. The second is judgement.
That judgement has become one of the more important parts of senior assurance work for me.
You still need to know the twelve facts. In fact, you probably need to understand far more than you eventually present, because without that depth you cannot know which details are safe to leave behind. Simplification without understanding is merely omission.
But once you understand the picture, carrying every piece of it into the executive conversation can make the assurance less useful rather than more.
The discipline is in knowing what the decision turns on.
I've sat in senior forums where a risk that could have been explained clearly in a few minutes became a twenty-minute technical discussion. Nobody said anything incorrect. The analysis was sound. The people presenting it knew their subject extremely well.
Yet somewhere in the explanation, the decision disappeared.
That experience gradually changed the question I ask myself before those conversations.
Not “What do I need to tell them?”
But “What do they need to be able to do when I finish?”
That small change has had a surprisingly large effect.
If the room needs to decide whether to proceed with a release, then the risk needs to be framed around that decision. If it needs to choose between remediation options, the relevant trade-offs need to be visible. If I'm asking an executive to accept residual exposure, they should be able to understand what they are accepting and why I believe that position is reasonable.
The analysis underneath may be identical.
The shape of the conversation changes because its purpose is clearer.
I also became much more deliberate about stating the implication.
Earlier in my career, I sometimes hesitated to do that. I would present the evidence carefully and assume the conclusion was apparent. There was a part of me that thought stating what the evidence meant might be overstepping. My role was to provide the facts; senior leaders could decide what to make of them.
Experience changed my view.
The same evidence can support very different interpretations depending on what somebody notices, what they already know and what pressures they are carrying. If the testing leader has spent days or weeks understanding the issue, it seems strange in hindsight to present all of that analysis and withhold the judgement it produced.
That doesn't mean making the decision for the executive.
It means completing the assurance.
There is a difference between saying “You must not proceed” and saying “Based on what we currently know, I would not recommend proceeding because this uncertainty leaves us unable to quantify the exposure.”
The accountability remains where it belongs. But the person making the decision now knows what the specialist who understands the evidence thinks it means.
I've found that senior leaders generally value that more than cautious neutrality.
They don't necessarily expect you to be right every time. They do expect you to have a view.
A risk presented without one leaves part of the work unfinished. The executive now has to interpret specialist evidence they may have encountered only minutes earlier and form a position that you, with considerably more context, were unwilling to form yourself.
That isn't always appropriate.
There are genuinely ambiguous situations where the evidence doesn't support a clear recommendation, and saying so is itself useful. But even then, the ambiguity should be explicit. Here is what we know. Here is what we don't. Here are the consequences of each path. This is why I cannot responsibly distinguish between them yet.
That is still judgement.
Perhaps the biggest change for me was realising that good risk communication isn't really about reducing complexity. It is about carrying the complexity on behalf of the room long enough to identify what matters.
That is a different responsibility.
It means the testing leader does the difficult work before the meeting rather than transferring that work into it.
None of this means softening a risk.
I've seen simplification used badly, particularly when delivery pressure is high. A serious exposure becomes a manageable concern. Uncertainty gets translated into confidence. Qualifications disappear because they make the message inconvenient.
That isn't framing. It is distortion.
The honesty of the picture cannot change simply because the audience has less time.
If anything, the less detail you present, the greater your responsibility to make sure what remains is faithful to the evidence underneath it. The room is relying on your judgement about what has been left out.
That reliance is easy to underestimate.
Over time, I've noticed that executives respond differently when they learn they can trust that judgement. They stop expecting a technical briefing every time you speak. They know that if something important has been omitted from the headline, it hasn't been ignored. They also know that if you tell them a risk is serious, the word hasn't been used casually.
Eventually, they start listening for your view.
That is when assurance begins to carry a different kind of weight.
It isn't because the testing has suddenly become better. It is because the organisation has learned that the person interpreting the testing can take a complicated position and make it clear without making it falsely simple.
I've come to think that is one of the foundations of executive trust.
Clarity on its own isn't enough. You can communicate something very clearly and still be wrong. Technical depth on its own isn't enough either. You can understand a risk better than anybody in the organisation and still fail to help the organisation act on it.
The value sits in bringing the two together.
That combination of judgement, communication and stakeholder confidence is also why I built the Stakeholder Management Masterclass for Test Leaders around more than the mechanics of stakeholder engagement. The challenge for senior testing leaders is increasingly not simply knowing what the evidence says. It is being able to carry that evidence into rooms where people have different priorities, different levels of technical understanding and accountability for decisions they still have to make.
Looking back, I think much of my early frustration came from assuming my responsibility ended once I had explained a risk accurately.
If the information was correct and complete, I believed I had done my part.
I hadn't.
Accuracy was essential, but it was only the beginning. The information still had to cross the distance between what I understood and what somebody else needed in order to make a sound decision.
I've worked with executives who were extraordinarily good at asking the questions that cut through that distance. They weren't short of information. If anything, they were surrounded by it. What they lacked was time, and they carried accountability for decisions across areas where they could never possess the same depth as the specialists advising them.
They didn't need me to give them everything I knew.
They needed me to know everything I reasonably could, and then exercise enough judgement to tell them what mattered.
There is a considerable difference between those two things.
It took me years to appreciate it.
The risk was rarely the hard part.
The harder part was understanding it deeply enough to give it to someone else in a shape they could actually use.
