For more than twenty years, risk management has been shaped by the gravitational pull of Sarbanes-Oxley. SOX arose from a genuine crisis of trust, and its intentions were honorable: to reinstate accountability, protect investors, and restore faith in financial reporting. But its unintended legacy has been far larger and far more limiting. Instead of elevating the role of risk management across the enterprise, SOX compressed it, concentrating the discipline into a narrow, compliance-oriented model rooted in documentation and evidence trails. Entire organizations came to believe that if they could prove controls were executed, they were “managing risk.” In reality, they were managing paperwork.
This is the heart of what I call the SOX Coloring Book: a worldview in which risk is represented not by thoughtful exploration of uncertainty but by grids shaded in red, yellow, and green. It is a worldview in which risk becomes a performative exercise for auditors rather than a strategic dialogue for executives. It is a worldview that keeps the discipline of risk firmly planted in the past, while the organization demands a capability oriented toward the future in decisions and achieving obectives.
SOX is not what risk management was meant to be. And it is not what OCEG envisioned when it articulated the modern definition of GRC as the capability to reliably achieve objectives [GOVERNANCE], address uncertainty [RISK MANAGEMENT], and act with integrity [COMPLIANCE]. That definition is perhaps the most concise articulation of what organizations require today. It places decisions, performance and objectives at the center, surrounded by the term governance, infused with integrity, and sharpened by a clear-eyed understanding of uncertainty.
The tragedy is that many U.S. organizations (and worldwide), under the long cultural influence of SOX, have inverted this model. They begin with compliance, shape risk around compliance, and never arrive at the horizon where objectives and strategy reside. Risk becomes mechanical rather than meaningful, captured rather than understood, constrained rather than harnessed.
How SOX Diminished the Discipline of Risk
The unintended damage of SOX is not the regulation itself but the mindset it produced. The act conditioned organizations to believe they were practicing risk management when they were merely validating control execution. SOX created a generation of leadership and practitioners who thought the essence of risk was:
- proving a control existed,
- documenting that it operated as designed,
- remediating deficiencies, and
- producing evidence to satisfy an auditor.
But this is not risk management; it is compliance maintenance. Compliance is necessary, even vital, but it is fundamentally backward-looking. Its responsibility is to confirm whether guardrails were followed, whether required steps were taken, whether behaviors aligned with expectations.
Risk management, by contrast, is about the terrain ahead, not the path behind. It is about anticipating what might influence objectives, understanding the potential pathways of uncertainty, preparing for resilience, and enabling the organization to move with confidence toward its goals.
When SOX became the archetype for risk, it pulled the entire function backward. Risk became episodic instead of continuous; administrative instead of analytical; procedural instead of strategic. It became a discipline obsessed with demonstration rather than insight. And because SOX rewarded proof over perspective, organizations increasingly staffed and structured risk functions to serve compliance needs rather than strategic ones.
The Problem With Heatmaps: When Color Replaced Analysis
As this mindset took hold, the visual language of risk followed suit. Heatmaps and RAG (red, amber, green) stoplight diagrams became ubiquitous—not because they provided meaningful insight, but because they were easy to generate, easy to present, and easy to misunderstand as “analysis.” They offered leaders the illusion that risk had been neatly captured on a single slide, when in truth, the most important dimensions of uncertainty were nowhere represented. Consider that . . .
- A heatmap cannot reveal the velocity of a risk, the speed at which it can materialize.
- It cannot reveal the interconnectedness of risks, the way supply chain fragility influences cyber exposure, or how geopolitical volatility alters operational resilience.
- It cannot reveal the depth of uncertainty surrounding a risk estimate.
- And it certainly cannot reveal how a risk influences—or is influenced by—the organization’s objectives.
Heatmaps turned risk into something decorative. They reduced uncertainty to a handful of colors. They made risk appear deceptively simple, concealing the fact that modern uncertainty is anything but. Heatmaps became the coloring book pages of risk management: tidy, symmetric, and ultimately disconnected from the strategic and operational realities leaders must navigate.
The greatest danger of heatmaps is that they create false confidence. Executives begin to believe that risks fit neatly into categories, that qualitative estimates are truth, that the world conforms to a grid of nine or sixteen cells. But the world is not a grid, and risk certainly is not. Risk is fluid, relational, systemic. It is shaped by context. It evolves by the hour. To reduce it to red, amber/yellow, and green is to flatten a three-dimensional world into a two-dimensional cartoon.
Reclaiming Risk as the Discipline That Guides Performance
To move beyond the SOX Coloring Book, organizations must return to the true purpose of risk management: supporting making decisions and the reliable achievement of objectives. This is where the OCEG model offers such clarity. Governance is the structure by which objectives are set and aligned. Risk is the engagement with uncertainty in pursuit of those objectives. Compliance is the assurance that integrity underpins the journey. Together, they form a coherent, integrated capability: GRC as an enterprise system of purpose, insight, and resilience.
When organizations treat risk as a compliance artifact, they prevent it from fulfilling this purpose. But when risk is understood as a proactive, decision-oriented discipline, it becomes the lens through which leaders evaluate choices, interpret signals, and understand the conditions under which performance will succeed or fail. Risk becomes an enabler of agility, not a barrier to it. It becomes the partner to innovation, not its adversary. It becomes the instrument through which strategy is informed, shaped, refined, and strengthened.
The shift required is not from bad tools to better ones; it is from a backward-looking posture to a forward-looking one. It is a shift from asking, “How do we demonstrate compliance?” to asking, “How do we navigate uncertainty to achieve our objectives?” It is a shift from cataloging risks to understanding relationships among risks. It is a shift from controlling yesterday’s failures to preparing for tomorrow’s realities.
This is why introspection is needed at all levels of risk practice.
The Three Levels of Risk & Resilience: A Narrative Architecture
If risk is to serve the enterprise, it must operate across three levels—each distinct, each essential, each reinforcing the others. These levels are not technical constructs; they are narrative layers of how organizations understand themselves, their environments, and their ambitions.
Strategic Risk & Resilience: Risk as the Author of Decisions
At the highest level, risk becomes a strategic companion to leadership. It is not there to prevent bold choices but to inform them. Strategic risk management is not a defensive shield but an interpretive intelligence. It allows leaders to envision multiple possible futures, evaluate emerging signals, and understand how forces — geopolitical, technological, economic, environmental — shape their pathways.
At this level, risk does not guard strategy; it guides strategy. It enables leaders to ask not only “What could go wrong?” but also “What must go right?” and “How do we steer through uncertainty to arrive where we intend?” This is risk as a cognitive asset, embedded in the executive conversation. It is the antithesis of the SOX view.
Objective-Centric ERM: Risk as the Interpreter of Performance
The second level — objective-centric ERM — is where risk meets the engine of the organization’s performance. Here, uncertainty is evaluated not in abstraction but in the context of what the enterprise is trying to accomplish. Traditional ERM often loses itself in risk registers and taxonomies. Objective-centric ERM resists this gravitational pull and instead keeps its focus on outcomes.
This level is where risk becomes integrated, proactive, and relevant. It fosters the conversations that matter:
- What uncertainties matter most to this objective?
- How does our understanding of risk shape our operational and strategic planning?
- What leading indicators must we monitor to anticipate shifts that affect performance?
By tying risk to objectives, the organization for the first time gains a risk management discipline that is not just descriptive, but decisive.
Operational Risk & Resilience: Risk as the Guardian of Today and Tomorrow
The third level — operational risk and resilience — provides the stability upon which all strategy depends. It encompasses the everyday realities of process reliability, system performance, third-party dependencies, and the organization’s ability to adapt to disruptions. Operational resilience is not merely the avoidance of failure; it is the active cultivation of durability and adaptability. It is the ability to perform today without compromising the capacity to perform tomorrow.
This is where risk takes physical form: where uncertainty meets operations, where resilience meets real-world conditions. Yet in many SOX-shaped organizations, operational risk was overshadowed by a far narrower focus on financial control testing. The cost has been a generation of firms less prepared for the complexity of modern disruption.
A Call to Action: Release Risk From the Coloring Book
To practice risk across these three levels, organizations require a modern architecture — one that moves far beyond the tools of the SOX era. This is what I refer to as GRC 7.0 – GRC Orchestrate with digital twins simulate the movement of risk. Agentic AI expands the capacity for monitoring, detection, and interpretation of signals. Shared ontologies create coherence across silos. Where risk management is architected in an orchestrated framework. These capabilities do not eliminate the human element; they enhance it. They allow risk professionals to spend less time compiling evidence and more time shaping insight. They allow leaders to make decisions with clarity rather than conjecture. They align the discipline of risk with the speed and complexity of the modern world.
The time has come for organizations to acknowledge the limitations of their inherited SOX risk paradigm. The SOX Coloring Book never did risk management. To navigate the world, organizations must release risk from the confines of compliance and restore it to its rightful place: as a strategic, objective-driven, forward-looking discipline intimately connected to the heart of performance.
Risk is how organizations make decisions.
Risk is how organizations pursue opportunity.
Risk is how organizations reliably achieve objectives.
Risk is our business.
And it is time to practice it as such.
