The Risk That Was Never on the Register

The board of a Caribbean food manufacturing and distribution company met in emergency session on a Tuesday morning in March. The previous Friday, their largest export market — a neighbouring Caribbean territory that accounted for thirty-two per cent of annual revenue — had imposed an immediate import ban on a category of processed foods following a food safety incident involving a competitor in a third country. The ban was not targeted at the company. It was a precautionary measure applied across all suppliers. But the effect was devastating: an estimated US$8.5 million in annualised revenue was suspended overnight, with no timeline for reinstatement.

The board’s first question was whether this risk had been anticipated. The managing director confirmed that it had not. The company maintained no formal risk register. There was no documented assessment of concentration risk in the company’s export markets. There was no business continuity plan that addressed the loss of a major market. There was no scenario analysis evaluating the impact of regulatory actions in export territories. The company had a general awareness that export dependence carried risk, but that awareness had never been translated into a structured analysis, a defined risk appetite, or a set of mitigation strategies.

The board’s second question was more uncomfortable: what other risks had not been anticipated? The honest answer was that no one knew, because the company had never conducted a systematic enterprise risk assessment. Risks were managed informally, based on the experience and judgement of senior management, without the documentation, structure, or board-level oversight that would have ensured comprehensive coverage and accountability.

Over the following six months, the company was forced to discount existing inventory at significant margin erosion, redirect production capacity at additional cost, negotiate emergency supply agreements with alternative markets on unfavourable terms, and draw down its credit facility to manage cash flow disruption. The total financial impact exceeded US$4 million. The reputational impact — suppliers questioning the company’s resilience, banking partners requesting updated financial projections, and key employees exploring other opportunities — was harder to quantify but no less real.

This fictional scenario, while not attributable to any specific Caribbean manufacturer, illustrates a vulnerability that Dawgen Global encounters across the region with troubling regularity: Caribbean enterprises operating without the enterprise risk management frameworks needed to identify, assess, mitigate, and monitor the risks that threaten their strategic objectives.

Why Enterprise Risk Management Matters Now

Caribbean enterprises operate in one of the most risk-dense business environments in the world. The region’s geographic exposure to hurricanes, earthquakes, and climate-related disruption creates a baseline of physical risk that most developed-market businesses do not face. Small, open economies with concentrated industry structures amplify the impact of any single disruption. Dependence on international trade, tourism, and foreign investment creates exposure to global economic cycles, geopolitical shifts, and policy decisions made in distant capitals. Evolving regulatory landscapes across multiple jurisdictions add compliance complexity. And the digital transformation of Caribbean businesses is creating cybersecurity, data protection, and technology risks that many organisations are only beginning to understand.

Against this backdrop, the absence of enterprise risk management is not merely a governance deficiency — it is an existential vulnerability. The company that does not know what risks it faces cannot prepare for them. The board that does not discuss risk systematically cannot hold management accountable for managing it. The organisation that lacks a risk appetite framework cannot make informed decisions about which risks to accept, which to mitigate, and which to avoid.

The global standard for enterprise risk management — embodied in frameworks such as COSO ERM and ISO 31000 — has evolved significantly over the past decade. Modern ERM is not a compliance exercise focused on documenting risks in a static register. It is a dynamic governance capability that integrates risk thinking into strategic planning, investment decisions, operational management, and performance evaluation. It connects the boardroom to the front line, ensuring that the people making daily operational decisions understand the risk boundaries within which they operate, and that the board has the risk intelligence needed to fulfil its oversight responsibilities.

The Caribbean Risk Management Gap

Risk Registers That Gather Dust: Some Caribbean organisations have risk registers. Far fewer use them. The typical pattern is familiar: a consultant is engaged to facilitate a risk workshop, a register is produced, management acknowledges the output, and the document is filed. It is not updated, not monitored, not reported to the board, and not integrated into decision-making. Within twelve months, the register is obsolete — overtaken by new risks that were never added and resolved risks that were never removed. The register becomes a compliance artefact rather than a governance tool. The root cause is usually the same: the risk register was created as a standalone exercise rather than embedded into the organisation’s ongoing governance processes.

No Defined Risk Appetite: Risk appetite — the amount and type of risk an organisation is willing to accept in pursuit of its strategic objectives — is the foundation of effective risk governance. Without a defined risk appetite, the board has no basis for evaluating whether management’s risk-taking is appropriate. Decisions about market expansion, credit extension, technology investment, and capital allocation are made without reference to the risk boundaries that should constrain them. In the Caribbean context, the absence of risk appetite statements is particularly consequential because many organisations are simultaneously pursuing growth strategies that increase risk exposure while operating in an environment where the consequences of risk materialisation are amplified by small market size, limited diversification, and thin capital buffers.

Risk Management Treated as a Finance Function: In many Caribbean organisations, risk management responsibility defaults to the finance department — or more specifically, to the CFO or a financial controller who adds “risk” to an already overloaded portfolio. This conflation of risk management with financial management creates two problems. First, it narrows the organisation’s risk perspective to financial and compliance risks while neglecting strategic, operational, technological, reputational, and external risks. Second, it places risk management under the control of a management function, reducing its independence and its credibility as a source of objective risk intelligence for the board.

Silos and Blind Spots: Even where risk management exists, it often operates in functional silos. The IT department manages cybersecurity risk. The compliance team manages regulatory risk. The operations team manages supply chain risk. Finance manages credit and liquidity risk. But no one integrates these perspectives into a holistic view of the organisation’s total risk exposure. The result is blind spots at the intersections: the cybersecurity vulnerability that creates a regulatory compliance breach, the supply chain disruption that triggers a liquidity crisis, the reputational incident that causes a correspondent banking relationship to be downgraded. Enterprise risk management exists precisely to eliminate these silos and provide the integrated risk perspective that boards need.

Climate and ESG Risk Ignored: Caribbean organisations are among the most climate-exposed in the world, yet climate risk is rarely incorporated into enterprise risk management frameworks in a systematic way. Physical climate risk — the threat of hurricanes, flooding, sea-level rise, and extreme heat to assets, operations, and supply chains — is understood intuitively but seldom quantified or scenario-tested. Transition risk — the business model implications of the global shift toward low-carbon economies, changing consumer preferences, and evolving regulatory requirements — is barely on the radar. ESG risks more broadly, including social licence to operate, workforce expectations, and governance transparency, are increasingly material to Caribbean organisations’ ability to access international capital, maintain partnerships, and attract talent.

Dawgen Global’s Enterprise Risk Management Framework

Dawgen Global has developed an Enterprise Risk Management Framework specifically designed for Caribbean organisations, built on international best practice (COSO ERM and ISO 31000) while accounting for the regional realities of small market size, concentrated ownership, limited specialist resources, and the multi-jurisdictional complexity that characterises many Caribbean enterprises.

Enterprise Risk Assessment: Dawgen Global facilitates comprehensive risk assessments that identify and evaluate risks across all categories — strategic, operational, financial, compliance, technological, reputational, and external — through structured workshops with board members, executive management, and key operational leaders. The assessment produces a prioritised risk profile that reflects the organisation’s specific context, not a generic template. Risks are assessed for likelihood and impact using methodologies that account for Caribbean-specific factors including geographic concentration, climate exposure, regulatory multiplicity, and supply chain vulnerability.

Risk Appetite Framework Design: Dawgen Global works with boards to develop risk appetite statements that define the boundaries of acceptable risk-taking across each major risk category. These statements translate the board’s strategic intent into practical risk parameters that guide management decision-making. The framework includes risk tolerance thresholds, escalation triggers, and key risk indicators that enable the board to monitor whether the organisation is operating within its defined appetite.

Risk Governance Architecture: Dawgen Global designs the governance structures needed to sustain effective risk management over time. This includes defining board-level risk oversight responsibilities, establishing risk committee terms of reference, creating management risk forums, designing risk reporting frameworks, and integrating risk management into the organisation’s strategic planning and performance management processes.

Scenario Analysis and Stress Testing: Dawgen Global conducts scenario analysis and stress testing that evaluates the organisation’s resilience to plausible adverse events. For Caribbean organisations, this includes hurricane and climate event scenarios, export market disruption scenarios, correspondent banking relationship loss scenarios, cybersecurity incident scenarios, and regulatory enforcement scenarios. The objective is not to predict the future but to ensure the board understands the range of outcomes the organisation might face and the adequacy of its preparedness for each.

Risk Culture and Embedding: Dawgen Global recognises that enterprise risk management is only as effective as the organisation’s risk culture. Frameworks that exist on paper but are not embedded in day-to-day decision-making produce compliance but not protection. Dawgen Global works with organisations to build risk awareness at every level, integrate risk thinking into operational processes, and create accountability structures that ensure risk management is everyone’s responsibility — not just the risk officer’s.

From Reactive to Resilient

The fictional food manufacturer that lost thirty-two per cent of its revenue overnight did not fail because of a bad product or a weak market. It failed because a foreseeable risk — export market concentration — was never formally identified, assessed, or mitigated. The board had no risk register to consult, no scenario analysis to reference, and no business continuity plan to activate. The company was operating without the governance infrastructure that would have transformed an external shock into a manageable disruption rather than a near-existential crisis.

Caribbean enterprises cannot afford this vulnerability. The risks are too numerous, too interconnected, and too consequential. The regulatory environment increasingly expects formal risk management frameworks. International partners, lenders, and investors evaluate risk governance quality as a factor in their Caribbean relationships. And the Caribbean’s unique exposure to climate, geographic, and economic concentration risks demands a level of risk preparedness that informal, intuition-based risk management cannot provide.

Enterprise risk management is not about eliminating risk. It is about understanding risk, governing risk, and ensuring that the risks an organisation accepts are consistent with its strategic objectives, its stakeholder expectations, and its capacity to absorb adverse outcomes. That understanding is the foundation of resilience.

Build Your Risk Management Framework

Dawgen Global invites Caribbean boards and executive teams to take the first step toward enterprise risk management maturity. Our Enterprise Risk Assessment provides a comprehensive, board-ready view of your organisation’s risk landscape and a prioritised roadmap for building the framework your organisation needs.

Request a proposal for Dawgen Global’s Enterprise Risk Management Framework Design. Email [email protected] or visit www.dawgen.global to begin the conversation.

About Dawgen Global