A risk register can look immaculate. Every policy signed off, every control attested, every committee minuted, and none of it tells you what happens when something actually goes wrong. Emmanuel Ranchin has spent a career in the gap between the two: the framework on paper, and the way it holds (or doesn't) when the pressure comes on. This conversation lives in that gap.
The document is a snapshot. The risk keeps moving.
Emmanuel's first point is that an attestation is a moment frozen in time. You test your resilience, you refresh the paperwork - and then, too often, it goes into a shared folder nobody opens again. Meanwhile the business changes, the vendors change, the threats change, and the document quietly drifts out of step with reality.
"Just because you've completed your resilience testing or your attestation refresh doesn't mean you pack that into a filing cabinet and never visit it again. It has to be accurate, current, and always challenged." - Emmanuel Ranchin
The real test, he says, isn't whether you can describe your framework to a regulator. It's whether the organisation can keep going when a risk event hits - whether processes bend, adapt and still deliver, rather than snapping.
Compliance can breed a dangerous kind of comfort
There's a version of "we're compliant" that's actually a risk in itself. Emmanuel has seen teams manage their compliance evidence beautifully, walk into a regulator's office as best in class, and then stop looking. The paper says everything is fine, so the search for the thing you haven't thought of quietly ends.
That, he argues, is where resilience and compliance part ways. Compliance asks: have we met the requirement? Resilience asks a harder question: it will happen, so how do we recover? The frameworks still matter, they're the map you reach for when the fog comes down and you've lost the landscape. But a map is not the same as knowing you'll make it home.
Where big institutions really break
Ask Emmanuel where large organisations fail and he doesn't point at technology. He points at the handoffs. Finance does its thing, HR does its thing, security does its thing - and at the seams between them, where one team's work becomes another's, nobody quite owns the flow. Every handoff is a point of fragility. Miss one, and finance doesn't process a salary run, and suddenly everyone is pointing fingers across the silos.
His fix isn't a new control. It's getting people in a room, mapping how the work actually moves, and letting the conversation itself start to dissolve the walls. Innovation, as he puts it, happens at the interface, the place where two worlds meet and someone is willing to understand both sides. It's the same instinct that let a chemical engineer read a bank's broken account-opening process and see, underneath it, the same failure modes he'd seen in a plant.
The risk was never really the framework. It's everything the framework stops you from looking at once you've decided it's done.
