Risk Management in Strategy Execution: Mitigating the Unknown

Most strategies do not fail because the presentation was poor, the ambition was wrong, or the leadership team lacked intent. They fail in the space between decision and delivery — where assumptions shift, constraints emerge, incentives compete, markets move, and execution risk becomes visible only after capital, time and reputation have already been committed.

For CEOs, this is now one of the central leadership challenges. Strategy execution is no longer a linear process of setting direction, allocating budgets and monitoring milestones. It is a live risk environment. The unknown is not an exception to be managed at the edge of the plan; it is part of the plan itself.

The World Economic Forum’s Global Risks Report 2026 frames the current environment as one in which leaders must balance immediate crises with longer-term systemic risks across multiple time horizons. The report draws on insights from more than 1,300 experts, underlining the breadth and interconnectedness of the risk landscape facing decision-makers. KPMG’s 2025 Global CEO Outlook found that 72% of CEOs have already adjusted their growth strategies to respond to ongoing, interconnected challenges. This is the environment in which strategy now has to be executed.

The risk is not only in the strategy. It is in the assumptions.

Every strategy carries embedded assumptions: about customer behaviour, cost of capital, technology adoption, talent availability, regulation, supply chains, competitor response, execution capacity and the organisation’s ability to change.

The danger is that these assumptions are often treated as background logic rather than active risk variables. Once the board has approved the strategy and the organisation has moved into execution mode, the focus can shift too quickly to milestones, budgets and reporting packs. The original assumptions are rarely revisited with the same discipline as financial performance.

That is where strategic risk begins to accumulate.

A market entry plan may depend on pricing power that weakens six months into execution. A digital transformation may assume data readiness that does not exist. A cost programme may deliver savings but damage customer experience or organisational energy. An AI initiative may attract investment but fail to move beyond pilots because the operating model, skills and governance were never properly aligned.

PwC’s 2025 Global CEO Survey points to this tension: CEOs are seeing early productivity gains from generative AI and returns from sustainability investments, but the challenge is to increase both scope and speed. In other words, value is not created by ambition alone. It is created by the organisation’s ability to execute under uncertainty.

Traditional risk management is not enough

Traditional enterprise risk management remains important. Boards still need risk registers, controls, assurance, compliance, audit oversight and clear accountability. But these mechanisms are often better at identifying known risks than navigating moving strategic uncertainty.

The unknowns that derail strategy are frequently not neat, isolated items on a risk register. They are shifts in interaction: between technology and people, regulation and operating model, customer expectations and cost structure, geopolitical uncertainty and supply chain design, capital allocation and execution capacity.

EY has argued that strategy and risk management now need to be aligned more closely, with strategy becoming more risk-informed and risk management more directly connected to strategic objectives and metrics. That is the right lens. Risk management should not sit outside strategy execution as a control function that reviews after the fact. It should be built into the way strategy is designed, sequenced, funded, governed and adapted.

The CEO question: what could make this strategy untrue?

A practical way to begin is for leadership teams to ask a sharper question:

What would need to change for this strategy to become wrong, delayed, unaffordable or irrelevant?

That question shifts the conversation from confidence to preparedness. It does not undermine conviction. It strengthens it.

The objective is not to make executives pessimistic. It is to make execution more intelligent. The best leadership teams do not pretend they can predict every disruption. They build execution systems that can detect weak signals early, respond quickly and preserve strategic optionality.

McKinsey has noted that only one in five companies believe they have high-quality strategy, and that “Strategy Champions” are not only strong at designing bold strategies but also at mobilising execution. This distinction matters. Strategy quality is not proven in the boardroom. It is proven in the operating cadence of the business.

Five disciplines for mitigating the unknown

1. Build a strategic assumptions register

Every major strategic initiative should have a clear assumptions register. This should not be a theoretical document. It should identify the handful of assumptions that matter most to value creation and execution feasibility.

For example:

• What customer behaviour are we assuming?
• What margin or cost assumptions underpin the case?
• What capability gaps must be closed?
• What regulatory, technology or market shifts could change the economics?
• What dependencies sit outside the direct control of the executive team?

Each assumption should have an owner, a confidence level, an early-warning indicator and a defined response if the assumption weakens. This makes the strategy easier to govern because leadership is not only asking, “Are we on plan?” It is also asking, “Is the plan still based on reality?”

2. Separate delivery risk from value risk

Many organisations track execution through scope, budget and timeline. These are necessary, but insufficient. A project can be on time and on budget while the original value case deteriorates.

PMI’s 2025 Pulse of the Profession emphasises the need for project professionals to move beyond budget, scope and schedule towards broader business value creation. This is critical in strategy execution. CEOs need visibility of both delivery risk and value risk.

Delivery risk asks: are we doing what we said we would do?

Value risk asks: will doing it still create the value we expected?

The second question is often the more important one.

3. Use staged commitment rather than all-or-nothing execution

In uncertain environments, major strategies should be designed with decision gates, not just milestones. A milestone confirms that work has been completed. A decision gate asks whether the organisation should continue, accelerate, pause, pivot or stop.

This is particularly important in digital, AI, market expansion, operating model and transformation programmes, where the learning curve is steep and conditions can change quickly. BCG notes that many transformations deliver short-term impact but fail to deliver long-term fundamental change; it identifies sustainable value creation, capability step-change and culture shift as critical outcomes.

A staged approach protects capital and management attention. It allows leadership to fund learning before scaling commitment. It also makes it easier to stop initiatives that are no longer strategically sound without treating that decision as failure.

4. Make risk part of the execution rhythm

Risk management in strategy execution should be embedded in the monthly and quarterly leadership cadence. It should not appear only at audit committee level or in periodic risk reporting.

The CEO and executive team should regularly review:

• which assumptions have changed;
• which risks are increasing or decreasing;
• where execution is creating unintended consequences;
• whether the organisation has the capacity to absorb the change;
• where decisions are stuck;
• which trade-offs need executive intervention.

This is where risk management becomes a leadership discipline rather than a compliance activity.

Deloitte’s Fall 2025 CEO Survey found that CEOs were focused on cost management, pricing, supply chain resilience and maintaining investment plans in a dynamic economic and trade policy environment. These are not isolated risks. They are execution variables that affect strategy in real time.

5. Create clear escalation rules

One of the most common failures in strategy execution is late escalation. Bad news moves slowly in many organisations. Teams try to solve issues locally. Sponsors remain optimistic. Dashboards stay green until they suddenly turn red.

To mitigate the unknown, leadership teams need explicit escalation triggers. These may include movement in cost assumptions, delayed dependencies, customer adoption below threshold, capability gaps, regulatory changes, technology underperformance, benefit leakage or organisational resistance.

The point is not to escalate everything. It is to escalate the right things early enough for leaders to act.

The board’s role

Boards should not be drawn into operational management, but they should insist on a more dynamic view of strategic risk. For major strategic initiatives, board reporting should include more than progress against milestones. It should include the status of critical assumptions, changes in the external environment, emerging execution risks, value realisation, decision gates and management’s response options.

This helps boards ask better questions:

• Are we still solving the right problem?
• Has the value case changed?
• What are we learning from execution?
• What risks are not yet visible in the numbers?
• Where do we need to preserve optionality?
• What would cause us to change course?

These are the questions that strengthen strategic resilience.

The leadership mindset shift

The unknown cannot be eliminated. It can only be surfaced earlier, interpreted better and managed with greater discipline.

For CEOs, the mindset shift is from certainty to readiness. A strategy does not need to predict every disruption to be robust. But it does need a management system that can absorb uncertainty without losing direction.

That means building organisations that are clear on intent, honest about assumptions, disciplined in execution, fast in escalation and willing to adapt when the facts change.

In a volatile environment, risk management is not the brake on strategy. It is one of the mechanisms that allows strategy to move at speed without becoming reckless.

The companies that execute best will not be those that claim to know the future. They will be those that understand what they do not know — and build that awareness into the way they lead, invest and deliver.