Risk Management, Operational Resilience and Sustainability: How to Turn Risk into Business Performance

Risk is no longer only a matter of compliance. It affects people, assets, operations, reputation, sustainability and long-term value creation. Companies that integrate risk management, safety, environment and ESG into their business processes can anticipate weak signals, reduce disruptions and make better decisions. This article explains why operational resilience, Enterprise Risk Management and safety culture should work together, and how organizations can measure their maturity through governance, behaviours and predictive KPIs.

Why risk can no longer be managed in separate silos

For many years, companies have managed risk through separate functions. Health and safety teams focused on accidents, procedures and legal requirements. Environmental teams monitored permits, waste, emissions and compliance. ESG teams worked on sustainability goals and reporting. Operations managed downtime, production continuity and supplier issues. Compliance teams controlled audits, documents and internal rules.

This structure may look clear, but it no longer reflects how risk works inside modern organizations.

Today, a safety issue can become an operational disruption. An environmental non-conformity can damage reputation and stakeholder trust. A weak safety culture can increase incident rates, reduce engagement and expose the company to hidden costs. A supplier failure can create production delays, contractual issues and ESG impacts at the same time.

Risk does not respect departmental boundaries. It moves across processes, people, suppliers, assets, governance and reputation. For this reason, companies need an integrated risk management approach that connects safety, environment, sustainability, compliance and operational resilience.

ISO 31000 describes risk management as a framework and process that any organization can use, regardless of size, activity or sector. It also links effective risk management to better identification of threats and opportunities, better allocation of resources and a higher likelihood of achieving objectives.

When each function works separately, the organization loses visibility. Leaders may receive many reports, but they may not see the connections between signals. A near miss, an audit finding, a recurring maintenance problem, a behavioural trend or a supplier delay may look like isolated events. In reality, they can reveal a deeper weakness in the system.

This is where integrated risk management becomes a business priority. It helps management understand how different risks influence strategic objectives, operational performance and long-term value creation.

What operational resilience really means

Operational resilience is the ability of an organization to continue delivering critical activities when disruption occurs. It does not mean that nothing will go wrong. It means that the company can anticipate, absorb, adapt, respond and recover without losing control of its essential processes.

Business continuity focuses on the ability to continue delivering products and services during a disruption, within acceptable timeframes and predefined capacity. ISO 22301 connects business continuity with resilience, risk identification, emergency preparation and recovery time improvement.

Operational resilience goes one step further. It asks a broader question: can the organization protect its critical operations even when stress increases, information remains incomplete and normal procedures no longer work as expected?

This is especially important for companies with complex operations, external contractors, regulated processes, environmental exposure, critical supply chains or high safety risks. In these contexts, resilience cannot depend only on emergency plans. It must live inside daily decisions.

A resilient organization knows its critical processes. It understands which people, systems, suppliers, assets and controls support those processes. It tests its ability to react. It learns from weak signals before they become incidents. It also creates a culture where people report, communicate and act before risk becomes damage.

ISO 22316 provides guidance to enhance organizational resilience for organizations of any size and sector. The standard does not impose one uniform model, because each company needs to adapt resilience to its objectives, context and risk profile.

Risk management and business performance: what is the connection?

Risk management does not only protect the company from negative events. It also improves the quality of decisions.

When managers understand risks clearly, they can prioritize investments, allocate resources, protect critical processes and reduce uncertainty. They can decide where to strengthen controls, where to simplify procedures, where to train people and where to redesign workflows.

This creates a direct connection between risk management and business performance.

A company that manages risk well can reduce operational downtime, incidents, rework, non-conformities, emergency costs, reputational exposure and loss of productivity. It can also make better strategic choices because it understands not only what could go wrong, but also which opportunities require stronger governance.

Academic and managerial literature has increasingly connected Enterprise Risk Management with performance, value creation and lower corporate risk exposure. Research focused on ERM and value creation in the Italian context also frames risk management as a process that supports company performance and strategic decision-making.

This does not mean that risk management automatically creates performance. The quality of implementation matters. A risk register without leadership commitment changes little. A compliance checklist without behavioural change does not build resilience. A KPI dashboard without decisions remains only a report.

Risk management improves performance when it becomes part of governance, planning, operations and culture.

Enterprise Risk Management: from risk control to value creation

Enterprise Risk Management, or ERM, helps companies move from fragmented control to integrated governance.

Traditional risk management often focuses on specific risk categories. One function manages safety risk. Another function manages environmental risk. Another controls legal or financial exposure. ERM connects these areas and links them to strategy, objectives and performance.

International Enterprise Risk Management frameworks highlight the importance of considering risk both in strategy-setting and in driving performance. This perspective shifts risk management from a defensive activity to a managerial discipline that supports better strategic choices.

This is a key point for top management. Risk cannot stay only inside technical departments. It must enter strategic discussions. It must influence investment decisions, organizational design, supply chain choices, people development and ESG priorities.

ERM helps leaders ask better questions:

Which risks can prevent us from achieving our objectives?

Which processes create the greatest exposure?

Which weak signals do we keep seeing?

Which controls work only on paper?

Which risks could become opportunities if managed earlier?

Which KPIs show real progress, not only past failures?

When companies use ERM in this way, they do not simply reduce risk. They create stronger alignment between governance, operational execution and value creation.

Safety, environment and sustainability: three dimensions of the same system

Safety, environment and sustainability often appear as separate topics. In practice, they describe different dimensions of the same organizational system.

Safety shows how the company protects people during daily operations. Environmental management shows how the company controls its impacts on natural resources, territory and regulatory obligations. Sustainability shows how the company creates value over time while considering people, environment, governance and stakeholders.

These areas meet inside real processes.

A production change can affect safety conditions, energy use, waste flows and employee workload. A new supplier can influence operational continuity, ESG performance and compliance exposure. A maintenance delay can increase safety risk, environmental risk and downtime risk at the same time.

For this reason, HSE and ESG functions need to work closely with operations, HR, procurement, legal and top management. Sustainability becomes credible when it enters processes and behaviours. Safety becomes stronger when leaders connect it to productivity, quality and operational discipline. Environmental management becomes more effective when companies treat it as part of business continuity and risk prevention.

AR19’s training catalogue connects culture, risk, safety, environment and sustainability with business performance. It also identifies leaders, operations directors, staff functions, HSE managers, sustainability managers, middle managers and supervisors as key roles for developing this integrated culture.

What happens when safety, sustainability and risk management are not integrated

When companies manage safety, environment, ESG and risk separately, they often discover the consequences only after a disruption, an incident or a non-conformity.

The most common effects include:

• Poor visibility across the organization. Each department may track its own indicators, but no one connects them. A rise in near misses, recurring audit findings and repeated maintenance delays may reveal the same organizational weakness. If the company reads these signals separately, it misses the pattern.

• Slow reaction times. When responsibilities are not clear, people wait for another function to act. This increases the time between signal, decision and corrective action. As a result, small issues can become larger operational problems.

• Inefficient investment. The company may spend money on training, audits, procedures or technology without addressing the real root cause. It treats symptoms, but the system remains fragile.

• Weak accountability. If risk belongs only to the HSE, ESG or compliance function, business leaders may see it as an external requirement. In reality, the people who design processes, set priorities and manage teams influence risk every day.

• Higher exposure to operational disruptions. A weak connection between risk management and operations can increase downtime, delays, rework and emergency interventions. This affects productivity and business continuity.

• Reputational risk. Stakeholders increasingly expect companies to show consistency between what they declare and how they operate. A sustainability report loses strength if the company cannot demonstrate control over safety, environmental and operational risks.

An integrated approach reduces these gaps. It does not remove complexity, but it helps the organization see risks earlier, assign clearer priorities and act before weak signals become critical events.

How to build a prevention culture

A prevention culture starts when the company stops treating risk as an administrative requirement and starts treating it as a shared responsibility.

Procedures matter. Training matters. Audits matter. But people make daily decisions in real contexts. They manage time pressure, production targets, incomplete information, operational habits and informal shortcuts. These elements can either strengthen or weaken risk management.

For this reason, culture plays a central role.

A strong prevention culture helps people recognize weak signals. It encourages them to report near misses and unsafe conditions. It gives supervisors the skills to lead safety conversations. It helps managers connect operational goals with risk perception. It also creates trust, because people know that reporting a problem leads to learning, not blame.

AR19’s approach to safety culture includes assessment, engagement, leadership development, safety coaching, communication, leading KPIs and strategic review. The method links culture to processes, systems, objectives, behaviours and motivation.

This matters because safety culture does not improve through slogans. It improves when leaders observe real work, discuss risk with people, identify recurring behaviours and create routines that support better decisions.

A mature prevention culture does not wait for the accident. It looks for precursors.

How to measure risk management and operational resilience maturity

Companies often ask how they can measure the maturity of risk management or operational resilience. The answer starts with a simple principle: maturity is not measured only by documents. It is measured by the way the organization behaves before, during and after critical events.

An effective assessment should consider several areas:

• Governance. The company needs clear roles, responsibilities, escalation criteria and decision-making processes. Leaders must know who owns each risk and how risks connect to business objectives.

• Critical process knowledge. The organization must identify its most critical processes and understand which people, assets, systems and suppliers support them. Without this mapping, it becomes difficult to protect operational continuity.

• Culture and behaviours. People must understand risks, report weak signals and apply safe behaviours even under pressure. This is where safety culture becomes a real indicator of organizational maturity.

• Data and indicators. The company must collect indicators that show both past events and future exposure. Lagging indicators explain what already happened. Leading indicators help management understand where risk may be increasing.

• Learning capability. After incidents, near misses, audits or disruptions, the organization must translate lessons into concrete changes. A mature company does not only record events. It learns from them and updates processes, behaviours and controls.

• Scenario thinking. Operational resilience also requires the ability to test possible disruptions. Companies should ask what happens if a critical supplier fails, a system stops, a key person becomes unavailable, a non-conformity emerges or a serious event affects operations.

This type of assessment helps management move from generic risk awareness to concrete priorities. It shows where the organization is strong, where it remains exposed and which actions can improve resilience, safety and business performance.

Which KPIs connect risk and performance?

Many companies still rely too much on indicators that describe what has already happened: accidents, injuries, lost time, environmental non-conformities, downtime, complaints or audit findings.

These indicators remain useful, but they do not provide enough early warning. They tell management where the organization has already suffered a loss, a deviation or a disruption. They do not always show where risk is increasing before the event occurs.

For this reason, companies should build a balanced KPI system that combines lagging indicators and leading indicators.

Useful lagging indicators include incident frequency, severity rate, downtime, recovery time, audit findings, non-conformities, claims and emergency costs.

Useful leading indicators include safety observations, near miss reporting quality, corrective actions closed on time, leadership safety walks, safety dialogues, training participation, risk assessment updates, contractor engagement, preventive maintenance compliance and completion of resilience tests.

For ESG and sustainability, companies can also track environmental deviations, energy performance, waste management, supplier assessments, employee engagement and ESG-related corrective actions.

The point is not to collect more data. The point is to choose indicators that support decisions. A KPI should tell managers where risk is increasing, where culture is improving and where the organization needs action.

AR19’s model focuses on predictive KPIs designed to measure the effectiveness of safety routines and cultural development actions. These indicators help the organization monitor progress before results appear only in incident statistics or non-conformity reports.

The model also includes strategic review with top management. This phase helps validate routines, review results, adjust priorities and define a scalable roadmap for long-term improvement.

The role of top management in risk governance

Top management has a decisive role in risk governance.

Leadership defines priorities. It decides which risks deserve attention. It allocates resources. It sets expectations. It influences how managers behave when production pressure conflicts with safety, environmental or sustainability objectives.

If top management treats risk as a compliance topic, the organization will do the same. If leadership treats risk as part of performance, people will understand that prevention, continuity and sustainability belong to the business model.

This does not mean that directors must manage every technical detail. It means they must ask the right questions and create the right conditions.

They should ask whether critical risks appear clearly in management discussions. They should check whether KPIs show early signals or only past failures. They should understand whether supervisors have the skills to influence behaviours. They should verify whether audits lead to improvement or only documentation. They should ensure that ESG goals connect to real processes.

Risk governance becomes effective when the board, executives, HSE, ESG, HR and operations share the same language.

How to integrate risk management, safety and ESG into business processes

Integration requires method. It cannot depend only on good intentions or isolated initiatives. To become effective, risk management, safety and ESG need to enter the way the organization reads its context, develops people, measures progress and reviews its priorities.

This is the logic behind the AR19 7 Steps Method, a structured approach designed to connect safety culture, environmental responsibility, sustainability and business performance through progressive phases of work.

The method can be organized around four main phases:

• Assessment and engagement. The first step is to understand the current level of maturity. This means analysing data, processes, rules, existing HSE and organizational systems, and the way people perceive and manage risk. It also means involving management and key roles through interviews, workshops, focus groups and field observations. The goal is to identify weak signals, critical behaviours and organizational factors that may affect safety, environment, sustainability and business continuity.

• Development. Once the organization understands its starting point, it can work on leadership, talent development, communication and safety coaching. Leaders, managers, supervisors and operational teams need practical skills to recognize risk, make better decisions, communicate safety values and apply routines such as safety meetings, toolbox talks, safety walks and safety dialogues.

• KPI and performance. Integration becomes stronger when the company defines clear objectives, actions and predictive KPIs. These indicators should not only describe what has already happened. They should help the organization understand whether safety routines, cultural development actions and risk management practices are producing real progress.

• Strategic review and long-term roadmap. The final step is to review results with top management, validate the effectiveness of routines, analyse predictive and historical indicators, and define a scalable roadmap. This allows the organization to consolidate change, adjust priorities and maintain improvement over time.

The AR19 7 Steps Method turns risk management into a living system. It helps the organization connect safety, environment, ESG and performance, while learning continuously and acting before weak signals become critical events.

From risk to resilience: the benefits for companies

An integrated approach to risk management, safety and sustainability creates tangible benefits for companies, especially when it becomes part of leadership, culture and daily operations.

The first benefit is stronger operational continuity. When the organization knows its critical processes, weak signals and key vulnerabilities, it can prepare for disruption before it becomes a crisis.

The second benefit is lower indirect cost. Incidents, non-conformities, downtime, rework, emergency actions and reputational exposure often generate costs that remain hidden until they affect performance. A stronger prevention culture helps reduce these losses.

The third benefit is better decision-making. Managers can compare risks, impacts and priorities with clearer information. They can act earlier, involve the right people and allocate resources where they create the greatest value.

The fourth benefit is greater trust. Employees, clients, suppliers and stakeholders see that the company manages safety, environment and sustainability with consistency. This strengthens reputation and supports ESG credibility.

The fifth benefit is higher organizational maturity. People become more aware of weak signals. Leaders become more responsible for behaviours. Functions cooperate around shared objectives. Safety, environment and sustainability no longer remain separate initiatives, but become part of how the company works.

In this sense, risk management becomes a performance lever. It protects value and helps the company create new value through stronger governance, better culture and more resilient operations.

AR19’s approach: safety, sustainability and performance integrated into business

AR19 supports organizations that want to connect safety, environment, sustainability and risk management with business performance.

This approach is based on the AR19 7 Steps Method, a structured pathway that helps companies move from assessment to cultural development, from predictive KPIs to strategic review.

The process starts with assessment and engagement. AR19 analyses the organization’s maturity level, existing processes, HSE and ESG systems, leadership behaviours, risk perception and weak signals. This phase helps the company understand where it is exposed and where it already has strong foundations.

The second phase focuses on development. AR19 works with leaders, managers, supervisors and operational teams through leadership training, safety coaching, communication plans, behavioural routines and talent development. The goal is to strengthen the human and organizational factors that influence risk every day.

The third phase connects KPI and performance. AR19 helps companies define predictive KPIs that measure the effectiveness of safety routines, cultural development actions and risk management practices. These indicators allow management to monitor progress before results appear only in incident statistics or non-conformity reports.

The final phase is strategic review and long-term roadmap. Together with top management, AR19 reviews results, validates routines, adjusts priorities and defines scalable actions to consolidate improvement over time.

The value of this approach lies in integration. Safety, environment, sustainability and performance do not remain isolated topics. They become part of how the company protects people, manages operations, develops leaders and strengthens resilience.

Conclusion: risk cannot be eliminated, but it can be governed

No organization can eliminate every risk. Markets change. Regulations evolve. Supply chains face disruptions. People make decisions under pressure. Environmental and social expectations continue to grow.

The real question is not whether risk exists. The real question is how the company governs it.

A mature organization recognizes weak signals early. It connects safety, environment, ESG and business continuity. It measures both results and predictive indicators. It involves top management. It develops leadership and operational behaviours. It turns prevention into a daily practice.

This is where the AR19 7 Steps Method becomes relevant: it gives companies a structured way to assess their maturity, engage people, develop safety and sustainability culture, measure progress and build a long-term roadmap.

Risk management then becomes more than compliance.

It becomes a way to protect people, strengthen operations, improve sustainability and create more stable business performance over time.

Frequently Asked Questions about risk management, operational resilience and sustainability

Why does risk management improve business performance?

Risk management improves business performance because it helps companies identify threats earlier, allocate resources better and reduce disruptions, incidents, non-conformities and hidden costs. It also supports better decisions at management level.

What is the difference between risk management and business continuity?

Risk management identifies, assesses and treats risks that can affect company objectives. Business continuity focuses on the ability to continue delivering products and services during a disruption. The two disciplines should work together.

What does operational resilience mean?

Operational resilience means that an organization can anticipate, absorb, adapt, respond and recover when disruption affects critical processes. It does not mean avoiding every problem. It means maintaining control when conditions change.

How can companies integrate safety and sustainability?

Companies can integrate safety and sustainability by connecting HSE, ESG, operations, HR and leadership. They should align objectives, share indicators, develop behaviours and include safety and environmental risks in business decisions.

Which KPIs help measure operational resilience?

Useful KPIs include downtime, recovery time, near misses, safety observations, corrective actions closed on time, audit findings, preventive maintenance compliance, resilience test results and supplier risk indicators.

How can risk management maturity be measured?

Risk management maturity can be measured through governance assessment, process mapping, audit results, culture analysis, KPI quality, leadership involvement, scenario testing and the organization’s ability to learn from events.

Why does safety culture affect business performance?

Safety culture affects business performance because behaviours, communication and leadership influence incidents, productivity, trust, engagement and operational discipline. A weak safety culture often creates hidden costs before it creates visible accidents.

What is the role of top management in risk management?

Top management defines priorities, resources, responsibilities and expectations. Leaders must connect risk management with strategy, performance, safety, sustainability and decision-making.

Does AR19 support companies in building integrated risk management, safety and ESG pathways?

Yes. AR19 supports companies through assessment, safety culture development, leadership training, safety coaching, ESG-related pathways, predictive KPIs and improvement roadmaps designed around the organization’s real context.

Alberto Rosso

CEO/Director AR19