I visited Karamoja in 2017 as part of the World Health Organization (WHO), anti-fraud risk management experts. In the evening, we had dinner with old men, one of them told us of a hunter who clutched his father’s map, drawn with charcoal on bark cloth.
Every morning, he set out with pride, tracing the same route. But the rivers had moved. The forest had burned. The buffalo no longer grazed there. He returned empty-handed every day. Until he died, not of hunger, but of refusing to see the change, and adapt.
That’s the story of many modern professionals. Especially risk managers.
Many still carry expired maps.
Here’s the hard truth: terrain has shifted, but your mind hasn’t.
Many ERM frameworks were made for a world where threats moved slowly, boards met quarterly, and risk meant paperwork. Today, cyber threats penetrate systems in seconds.
Social media can destroy a reputation overnight. A junior staffer with admin access is more dangerous than a thousand external hackers. In our Summit Consulting iShield 360 Project Frontline, where we compile common cybersecurity breaches and attack surface mapping, we find internal threats are one of the biggest risks.
Still using static registers? Still reporting risk by likelihood and impact without real-time context? Still waiting for the audit cycle?
That map has expired.
I met a risk leader last month. Brilliant, articulate, been in the game for 15 years. He showed me his updated risk matrix. I asked him for a better decision. When did this make the company innovative?”
He paused.
Then admitted: “It’s never used. We just updated it for the committee.” He’s navigating a digital storm with a colonial-era compass.
Risk managers, your job is not to maintain old controls. Your job is to detect new dangers before they surface.
It’s not about being reactive. It’s about being strategic. You must become the intelligence officer of the business, not the compliance custodian.That means:
- a) Ditching the checklists and learning to scan the horizon.
- b) Using dashboards, not documents.
- c) Speaking in business impact, not just probability.
- d) Leading change, not lagging behind it.
The world has changed. Have your thinking?
Ask yourself: Are you the hunter clinging to bark cloth in a city of satellites? Or are you drawing a new map?
This is your chance for reinvention. Tear the old one. Use data. Use instinct. Walk the terrain. Talk to real people. Challenge the models. Then build risk tools that your CEO uses.
A risk manager who still uses expired maps is not just lost—they’re dangerous.
The most valuable people in any company are not the ones who follow the rules. They’re the ones who rewrite the map when the road disappears. Be that person, or be replaced by them.
What expired map are you still following?
I remain, Mr Strategy.
