People often speak about risk as though it were something that can be eliminated with enough systems, enough reporting or enough regulation. After many years working in banking and around boardrooms, I came to a different view – risk itself isn’t the problem, leadership behavior usually is.

Large organizations today generate extraordinary amounts of data. Banks especially produce endless reporting, metrics, dashboards and analysis. Yet institutions still get into trouble, sometimes very serious trouble.

In my experience, this rarely occurs because there was no information available somewhere in the system. More often, the information existed but was misunderstood, badly communicated, ignored or never properly discussed.

The understanding gap

Good information matters enormously, but information alone is not enough. It has to be distilled from vast amounts of data, verified, placed in context and made coherent. That sounds easier than it is.

A friend of mine, Mark, was recruited as ANZ’s first chief risk officer after the bank incurred large losses on Russian bonds in 1998. At the time, ANZ’s CEO John McFarlane publicly stated the bank had not known it owned them. Mark later remarked that it took the bank three years to fully understand what it actually held.

That observation stayed with me because it says something important about modern institutions. Complexity creates false confidence. Organizations often assume that because information exists somewhere, there is understanding. But information and understanding are not the same thing.

Boards therefore have an obligation to insist on reporting that is comprehensive, accurate and timely, but also genuinely useful. Over time, a good risk report should become more than a compliance exercise. It should help create a shared understanding among directors and management about the organization’s real risk position and how that position may be changing. But reports and systems only take you so far. Behavior matters more.

One of the strongest indicators of institutional health is whether bad news can safely travel upwards. Statistics such as customer complaints, regretted staff departures or system outages can provide important warning signs. But ultimately, it is management and board behavior that determines whether those warnings are heard early enough to matter. People need to feel safe speaking honestly.

Senior executives cannot always be expected to challenge a chief executive directly and repeatedly. The personalities that rise to the top of major organizations are often decisive, ambitious and highly confident. Those qualities are necessary in leadership, but they can also discourage disagreement if they are not balanced by humility and self-awareness.

Managing uncertainty

Over recent years regulators have increasingly focused on the board’s role in constructively challenging management. In banking particularly, this has become recognized as an essential safeguard rather than simply a governance ideal. In practice, however, challenge is not a mechanical process. It is cultural.

A board’s primary tool for making risk judgments is conversation. Difficult issues are rarely resolved by numbers alone. Directors need to talk things through properly, sometimes repeatedly, testing assumptions, approaching the same issue from different angles and combining both quantitative and qualitative judgment.

That takes time and it requires a degree of openness. Some of the most valuable conversations occur around the edges of official agendas rather than during formal presentations. Informality matters more than many organizations recognize.

Good directors respect each other’s experience, tolerate different styles of thinking and sometimes allow somebody to pursue what appears initially to be a minor point because experience tells them the observation may matter later. Judgment does not emerge from process alone.

One of the risks in modern governance is the belief that increasingly elaborate systems will somehow remove uncertainty from leadership. In reality, leadership is the management of uncertainty.

The objective is not to eliminate risk altogether. No serious organization can operate that way. The objective is to think clearly about risk, discuss it honestly and avoid becoming trapped by overconfidence or institutional groupthink. Time is important here too.

Hard calls first

A board’s scarcest resource is not information. It is time and attention. Boards should focus most heavily on matters involving difficult qualitative judgment about risk, fairness, culture and long-term consequence.

Too many organizations exhaust energy on operational trivia while compressing genuinely difficult discussions into the final part of meetings when people are already tired. I have often thought boards would make better decisions if they simply reversed many of their agendas and dealt with the hardest matters first.

Ultimately, strong institutions are not institutions that avoid risk. They are institutions that remain intellectually honest about it. They encourage challenge. They allow difficult conversations to occur. They understand that culture matters as much as systems. And they recognize that leadership judgment, particularly under pressure, will always matter more than any reporting framework.

In my experience, institutions rarely fail because nobody knew there was a problem somewhere in the system. More often, they fail because people stopped listening carefully enough, stopped questioning assumptions or became too certain they understood what was really happening.

Opinions expressed by The CEO Magazine contributors are their own.