From Risk Lists to Uncertainty: How BIG and OCRUM Close the Mission-Critical Oversight Gap

Webinar: 3/12/25 – event report – David Dunning

Introduction

This session brought together practitioners who want governance systems that speak honestly about uncertainty and who are looking for practical ways to connect strategy to delivery. The discussion compared the OCRUM methodology and the BIG framework. More importantly it tested the cultural and organisational conditions needed for objective-centric oversight to take hold.

Why both frameworks exist

Tim Leech opened with a blunt diagnosis. Boards typically receive three familiar products: the strategic plan, a list of principal risks, and internal audit reports. What they do not receive is a realistic, evidence-based view of the uncertainty surrounding the organisation’s mission-critical objectives.

Editors note – looking at some reactions – this was received with a little bit of disbelief. I suspect some in the group had perhaps not thought this to be even possible. Others, who have delivered strategy management solutions, perhaps thought this was less prevalent than Tim suggested. But no one pushed back hard on the proposition.

These objectives sit at the heart of value creation and value preservation, yet the information provided to boards rarely describes their true likelihood of success.

Tim argued that risk functions have slipped into a supply-driven mode. They generate artefacts that satisfy regulation rather than insight. The ISO definition of risk may mention uncertainty on objectives, but in practice most organisations focus on lists of hazards and controls that sit some distance from what actually makes or breaks the strategy.

Read about BIG here and why we started it

The cultural barrier no framework can solve for you

A recurring thread was the quiet but powerful “don’t ask, don’t tell” compact that exists in many organisations. Executives fear that sharing uncertainty invites challenge, intervention, or reputational harm. Boards, in turn, often avoid probing too deeply. Risk and audit teams, unintentionally, reinforce this pattern by reporting symptoms rather than uncertainty. The conclusion was uncomfortable but clear: no framework will bite unless leaders genuinely want to know, and are ready to finance, hear, and act on objective-centric insight.

Editors note – If this is the case – how is a logical argument to improve governance around strategy delivery – based on diagnosis of the status quo – every going to gain traction with those who have the authority / influence to make it happen….?

What OCRUM brings to the table

Tim set out how OCRUM imposes clarity and discipline. It begins by agreeing a short list of mission-critical objectives, each with a named owner. Those owners must make a judgement on the current level of uncertainty, set out what is influencing it, and declare whether the current state is acceptable. The reporting can be brief or detailed depending on culture and complexity, but the expectation is consistent: think seriously about uncertain outcomes, describe them openly, and expose any gap between what is acceptable and what is real. Boards can request independent assurance whenever the stakes demand it.

Tim presented a process to engage boards to initiate management of its MCOs – which – given the right will and support – could take about a month.

See more about OCRUM here

Where BIG fits

David connected this to the BIG framework. While OCRUM establishes how boards should define and oversee critical objectives, BIG provides the operating system that allows those disciplines to run. It links purpose, strategy, objectives, delegation, accountability, resources, and information flow in one architecture.

Editors note – tackling mission critical objectives provides a laser like focus on what should matter for boards (or matter for someone). While making a case to improve the ecosystem to manage strategy delivery might sound a little grandiose for some executives and board members – an entry point via MCOs (perhaps in business planning, merger / acquisition, new CEO) is a good foot in the door to start to justify shaping the organisation to operate strategy more effectively.

The two approaches share an assumption that objectives must be owned, authority must match accountability, and priorities must be understood across the whole organisation rather than buried within departmental silos.

However – to build the operating model to cope with Mission Critical Objectives – track purpose to vision, then MCO into delivery and back again – there are many bodies of knowledge we need to consult – to fill the colour into a BIG Framework.

What participants surfaced

Participants recognised how easily frameworks become cluttered when every function adds its own requirements. Several reflected on how OCRUM’s disciplined treatment of mission-critical objectives could cut through this and restore focus. Others were interested in how digital twins or organisational knowledge systems could map dependencies and owners in a way that supports objective-centric thinking. But the strongest point of consensus was cultural. Unless leaders break the tacit “don’t ask, don’t tell” habit, the machinery will achieve little more than technical compliance.

Did we meet the aim of the session?

Judging by the discussion, yes. The group now has a shared understanding that OCRUM provides the mindset, principles, and lexicon for governing uncertainty, while BIG gives the organisational mechanics needed to embed those disciplines.

The challenge is not the logic of either approach. It is whether boards and executives want a view of uncertainty that may challenge comfort, routine, and reputation.

Editor Reflections to close

Most people are not unwilling to be accountable. They are unwilling to be personally exposed in environments where accountability is ambiguous, leadership reactions are unpredictable, and raising concerns carries more risk than reward. In that context, Don’t Ask, Don’t Tell is not dysfunction but self-protection. We should not dismiss this instinct, but we can design systems that replace fear with fairness.

A rational, fair model of accountability needs a few essential ingredients:

• Purpose to provide the focus for everything else – board purpose as well as organisation purpose.
• Mission-critical objectives form the backbone of strategy delivery – and clarity on who provides oversight
• Management must tell. Boards must ask. i.e. an effective governance culture
• Oversight duties tied directly to mission-critical objectives.

Hence – OCRUM provides a means to engage boards and executives in what should be important to them. The BIG framework offers a practical blueprint that balances strategic, regulatory, operational, and emergent demands inside one operating model.

A final thought, borrowed from one of the wiser voices in the room: Don’t Ask, Don’t Tell survives in darkness. It dies in sunlight.

If anything from this account feels incomplete, those who attended should add their perspectives. Fresh insight sharpens the practice for all of us.

Become a BIG Full Member or a Conference to access the session recording, slides and discussion for all previous and future Conference events. Receive a discount code to book onto future events:

• 10^th  December 12.30 PM UK – Mind the Gap: Strategy, Execution and Portfolio Management

Also – IASP Event:

• 9^th December 6 PM UK – IASP UK Strategy Debate – LinkedIn Post here
• What is the role of luck in strategy?
  • Book directly here