Most Boards have approved a risk investment they would have declined 18 months earlier, and declined one they will approve 18 months later. Very often nothing about the underlying risk changed in between. What changed was the news.
That pattern usually gets read as a failure of discipline. I think it is structural, and I think the Dutch stumbled onto the fix while solving an entirely different problem.
A cheaper option, declined
In the 1990s the Netherlands abandoned its centuries-old approach to river flooding. Rather than keep raising the dykes, it decided to give the rivers more room: moving dykes landward, lowering floodplains, cutting new side channels, and in places handing land back to the water. The programme, Room for the River, ran from 2006, delivered 39 separate measures for around €2.3 billion, and lowered flood levels across the Rhine branches by roughly 0.3 metres.1
It was the harder option by every measure a business case would recognise. Raising dykes is well understood, largely contained within engineering, and asks nobody to give up land. Room for the River needed land acquisition, planning approvals, and the cooperation of municipalities being asked to accept a river closer to them. It cost more and it took longer.
It got built anyway. The reason should interest any Director who has watched a resilience proposal die quietly in a prioritisation meeting.
Two objectives, written into the decision
The enabling instrument, a Spatial Planning Key Decision taken at national level, did not set one goal. It set two. Every measure had to deliver flood safety and enhance spatial quality: the amenity, ecology and economic value of the place it was built in.
That is not a benefits paragraph appended to a business case. It was a condition of the work.
What made the second objective real
Two objectives on paper are easy. Most organisations already have them, in the form of benefits realisation sections nobody reads again after approval.
The Dutch did something more interesting. They established an independent, multidisciplinary Quality Team, known as the Q-team, which coached the design teams, peer reviewed every plan, visited each project at least three times, and reported to the minister on the spatial quality actually achieved. It kept a written record of its recommendations and its final judgment on each project, and it reported publicly at intervals across the life of the programme.2
So the second objective had its own assurance function, its own evidence trail, and a reporting line that went over the heads of the people delivering the projects. It could not be quietly dropped when a schedule tightened.
Why risk investment competes badly
Here is the governance problem that solves.
An investment that only buys the avoidance of a bad thing has no objective to attach to. It is defined by an absence. Put it alongside a proposal that opens a new revenue line, reaches more members, or removes a cost the CFO can point at, and it loses. Not because Directors undervalue risk, but because they are being asked to compare something concrete against something hypothetical.
Security and resilience controls end up competing on fear, and fear always loses to revenue. This is why. The competition is decided before the papers reach the Board, by the way the proposal was constructed.
A second objective changes the terms. An investment that reduces exposure and delivers something the organisation wanted anyway is no longer competing on fear. It competes on merit, with the risk reduction included in the price.
The obvious way to get this wrong
The failure mode is not subtle. Tell an executive team that risk proposals need a second objective and some of them will invent one. Benefits appear in the paper, get counted at approval, and are never mentioned again.
Three things separated the Dutch version from that. The second objective sat in the enabling decision rather than the business case, so it was a condition rather than a justification. It was assessed by people who were not delivering the work. And the assessment was documented project by project, so the judgment outlived the approval.
A Board can reproduce all three without standing up a Q-team. It takes asking, at the point of approval, what else this delivers, who is accountable for that part, and how we will know. Then asking the second question again 12 months later.
Not everything has a second objective
Some controls do not have one, and pretending otherwise is precisely how benefits theatre starts.
Plenty do. Retiring legacy systems lowers running cost and removes exposure at the same time. Cleaning up identity and access speeds onboarding and limits how far an intruder can travel. Reducing what the organisation collects and how long it holds it cuts storage cost, simplifies privacy obligations, and shrinks what is available to lose. Segmentation improves change safety as well as containment.
But an incident response retainer, a monitoring capability, or a tabletop exercise programme mostly buys the avoidance of a bad thing and little else. Those deserve funding on their own merits, and the useful move is for the Board to say so explicitly rather than let them compete in a process they cannot win.
Who chooses the measure
One more detail is worth taking. The 39 measures were settled nationally, but delivery was devolved to regional and local authorities, and in some cases to private parties. The centre set the outcome and the two objectives. It did not tell each locality how to meet them.
That is a clean division of labour, and it maps onto the Board and management relationship rather better than most governance diagrams do. The Board sets the outcome standard and insists on the second objective. Management chooses the measure.
A question for your next risk paper
Which of our resilience investments would still be funded if the threat narrative went quiet for two years?
Whatever survives that test is attached to something the organisation genuinely wants. Whatever does not is running on fear, and fear is a funding source with a short half-life.
The Dutch paid more, took longer and involved far more people than the cheap option required. They also ended up with a river system that is safer and a set of places that are better to live in. The harder path was chosen deliberately, and the second objective is the reason it was politically possible at all.
1. Room for the River (Ruimte voor de Rivier), Spatial Planning Key Decision, Government of the Netherlands, 2006.
2. “Design quality of room-for-the-river measures in the Netherlands: role and assessment of the quality team (Q-team)”, International Journal of River Basin Management, vol 11 no 3, 2013.
This article reflects the author's own analysis, experience, and professional judgement. AI tools were used during drafting to assist with structure, editing, and refinement. The ideas and positions expressed are entirely the author's own.
For more on how Wilk Advisory uses AI, see our AI use statement.