Are You Managing Risk or Just Reacting to It?

By Dan Wahlberg, CPA | May 2026

Most businesses discover gaps in their risk management only after something goes wrong — a key client walks, a compliance issue surfaces, a key employee leaves, or a market shift catches them flat-footed. By then, the cost of not having asked the right questions earlier is already being paid.

As a CPA and business advisor working with Maryland middle-market companies for over 25 years, I’ve seen this pattern repeatedly. The businesses that weather disruptions best aren’t the ones that got lucky — they’re the ones that built a habit of asking hard questions about risk before they had to.

You don’t need a formal board of directors to think like one. The following questions, adapted from a governance framework developed by BDO, are ones I’d encourage every business owner and leadership team to work through at least once a year.

Your Risk Environment

• Do you have clear accountability for risk in your organization — meaning specific people own specific risks, not just “everyone is responsible”?
• How well is your leadership team managing risks to your revenue, margins, key assets, and reputation? How do you actually know — what’s the evidence?
• If a significant new risk emerged tomorrow — a regulatory change, a major customer loss, a cybersecurity incident — how quickly would it reach your attention, and would you have time to act?

For many of my clients, the honest answer to that last question is “not fast enough.” Building even a simple early warning process — regular leadership check-ins, a short list of key risk indicators you monitor monthly — can change that.

Your Risk Assessment

• Are the risks you’re focused on actually aligned with your growth strategy? Many businesses over-invest in managing risks that are unlikely or low-impact while underinvesting in the ones that could genuinely derail the business.
• For your most significant risks, have you made a deliberate decision about whether you’re mitigating them, accepting them, or transferring them (through insurance, contracts, or other mechanisms)?
• When did you last seriously challenge whether your assumptions about your business model are still valid? Industries change, customer expectations shift, and the risks that mattered three years ago may not be the ones that matter most today.

This is where outside advisory relationships earn their keep. It’s hard to see your own blind spots. A good CPA or business advisor should be pushing you on these questions, not just filing your returns.

Your Risk Monitoring

• Are the right risk signals reaching the right people in your organization with enough time to act? Or do problems typically surface at the worst possible moment?
• How do you know your business is operating within the financial, compliance, and ethical standards you’ve set — and that deviations are being caught and addressed promptly?
• If your business faced a serious disruption tomorrow — a key employee departure, a major contract loss, a data breach — do you have a realistic, tested response plan? Or would you be improvising?
• Are you taking advantage of technology and automation to detect and flag emerging risks faster? And if you are, are you thinking carefully about the new risks those tools introduce?

What This Means in Practice

You don’t need to answer all of these perfectly. The goal isn’t a perfect risk management program — it’s developing a leadership habit of asking the right questions regularly, before the answers are forced on you by events.

For my clients, this usually starts with a simple annual conversation: What are the three risks that keep you up at night? What are you actually doing about them? And what would it cost your business if one of them materialized?

If you haven’t had that conversation recently — with your leadership team, your board, or your advisors — it’s a good time to start.

Book a business advisory consultation with Acclare Solutions

Source: Questions Every Board Should Ask About Risk Management — BDO