Key Takeaways
- Named owners, trigger conditions, and documented next steps are what separate a contingency plan from a good intention. When a risk materialises, the response should be a phone call and a checklist, not a meeting to decide who does what.
- Risk treatment is a set of options rehearsed in advance, so the decision under pressure takes seconds. The manager who knows exactly which substitute addresses which scenario is doing the same thing a risk manager does when they assign a contingency measure before it is needed.
- Every buffer, whether financial, schedule, or injury time added at the end of a match, should map back to a specific risk. A contingency figure that cannot be traced to a named risk and a probability is a guess with a percentage sign.
- The scenario you hope never arrives, penalties, insolvency, a failed audit, a supply chain collapse, is the one most worth preparing for in detail, precisely because the cost of improvising when it does arrive is always higher than the cost of preparing when it does not seem necessary.
- Risk management works when every member of a team has a defined role in it. A register that one person owns, one person updates, and nobody else reads is a single point of failure wearing the costume of a process.
The World Cup 2026 is underway, and forty-eight national squads have spent months preparing for every scenario they hope not to face: penalty shootouts, injuries to the first-choice striker, a red card in the opening fifteen minutes. Many organisations have not thought half as carefully about their own risks.
Risk management is the process of identifying what could go wrong, deciding how seriously to take each possibility, and putting concrete steps in place to reduce the likelihood or limit the damage. It is not a spreadsheet you fill in before an audit but the same structured thinking a good football manager applies before every match, whether or not they would use that name for it.
This article draws the parallel section by section. If you have never thought formally about risk management, the football analogy gives you the shape of it. If you manage risk professionally, it is a useful reminder that the fundamentals are straightforward. The tools that make them work are what separates good risk management from good intentions.
The manager is the risk manager
A football manager's job is to make sure the team is prepared, that risks are identified in advance, and that when something goes wrong, the response is already in the playbook.
Before the match, the manager studies the opposition. Which players are dangerous? Under what conditions do they cause damage? Is there a weakness in our defence that matches their strength? These are risk identification questions, and the manager is building a risk register even if it lives in a notebook or on a whiteboard instead of a piece of software.
Then comes the assessment. A powerful centre-forward is more dangerous than a slow winger on a heavy pitch, and not every threat is equal. The manager weighs probability and impact, allocates defensive resource accordingly, and makes a call that is, in effect, the risk assessment.
What the manager avoids is waiting until minute 70 to start thinking about contingency. The substitutes are warming up because they were always part of the plan, and the tactical switch to a back five was rehearsed on Wednesday. The team knows what to do when things shift because the manager made sure they did before kick-off.
That is the central insight of risk management: the best responses are prepared in advance, not assembled under pressure.
Substitutes as contingency measures
In a well-managed squad, each substitute has a clear purpose rather than being an afterthought. One is on the bench because the first-choice right back has been struggling with a hamstring. One is there to add pace in the final twenty minutes if the team is chasing the game. Another is there because the opposition's press tends to tire in the second half and a high-energy midfielder can exploit that.
Each substitute is, in effect, a named contingency measure with a trigger condition. "If X happens, we do Y, and [name] is the person who does it."
This is exactly what a risk measure looks like in a functioning risk register. A measure without an owner is decoration, and a measure without a trigger, a defined point at which it gets activated, is a hope rather than a plan.
During World Cup 2026, you will see this play out in real time. The managers who use their bench well are executing decisions they had already made rather than reacting to events. The substitution at minute 65 was written into the gameplan at minute zero.
The organisations that handle operational disruption well do the same thing. They have identified the risks in advance, assigned owners to the contingency measures, and agreed on the conditions that trigger each one. When the risk materialises, the response is a phone call and a checklist, not a three-hour emergency meeting that could have been a plan.
Tactics as risk treatment strategy
Risk treatment is the set of options you choose when you decide how to respond to a risk. You can try to prevent it from happening, reduce its impact if it does happen, transfer it to someone else through insurance or a contract, or accept it because the cost of doing anything else outweighs the benefit.
A football manager makes all four of these calls every week, usually without naming them.
Pressing high up the pitch is a prevention measure. Stop the opposition building from the back and the dangerous through-ball never arrives. Dropping into a low block when protecting a lead limits impact: the opposition will have the ball, but the damage will be contained. Taking out insurance on a key player is a literal transfer of financial risk. And sometimes a manager accepts that the opposition's best winger is just better than their full-back and focuses energy elsewhere.
None of this is instinct. It is structured thinking applied under time pressure, and the same options are available to any organisation managing risk. Prevention and mitigation measures sit at opposite ends of the same bow-tie diagram: one side works to stop the risk from triggering, the other limits the damage once it has. Good risk management uses both.
The teams that struggle, on the pitch and in organisations, are the ones that default to a single response type. The manager who only ever defends and the operations team that only ever reacts share the same weakness. A range of prepared treatments, matched to specific scenarios, is what creates resilience.
Injury time as the contingency budget
Referees add injury time at the end of each half to compensate for stoppages: substitutions, VAR checks, a player spending slightly too long celebrating. The time added is a buffer built into the game structure, proportionate to what actually occurred.
A contingency budget works the same way. The number should map back to specific risks, weighted by probability and impact, so there is a defensible answer when someone asks where it came from. A figure of "10% because that feels right" is not a contingency budget. It is a guess with a percentage sign.
This is where many organisations go wrong with contingency. The buffer exists but nobody can explain it. It was added in a meeting, agreed by feel, and now sits in the project plan doing quiet work that nobody can trace back to a decision.
Monte Carlo simulation is one way to close that gap. By running the risk register through thousands of scenarios, sampling from the probability distributions of each risk, you get a range of outcomes with percentiles attached. The P85 figure is the number your register produces when you stress-test it properly, and when the board asks why the contingency is set at EUR 850.000, the answer exists in the model rather than in someone's memory of a conversation from three months ago.
Injury time, at its best, is a calculated buffer tied to a real accounting of what happened and what might still happen. A contingency budget should meet the same standard.
Penalties: the scenario you prepared for and hoped to avoid
Nobody wants a penalty shootout. They are stressful, partly random, and entirely avoidable if ninety minutes of football goes according to plan. And yet every serious international team practises penalties. They know the order, they have analysed the opposing keeper's dive tendencies, and they have done this work in the hope that it never matters.
This is the correct relationship with worst-case scenarios.
The temptation in organisations is to avoid planning for the scenarios that feel too bad to contemplate: the major supplier failing, the key system going down for three days, the audit uncovering a compliance gap that should have been caught two years ago. These are the scenarios that most merit preparation, precisely because they are the ones where improvisation is most costly.
A risk register that only lists medium-probability, medium-impact risks is a register built for comfort. The high-impact, lower-probability risks, the ones that sit quietly in the red zone of the risk matrix, deserve a detailed response plan with named owners and a tested sequence of steps.
The manager who runs penalty practice on Thursday afternoon is being honest about what the tournament might require, and professional enough to prepare for it regardless.
The club board asks for a picture of current exposure
After every match, the manager answers to the club board about whether the squad is fit, whether injuries are manageable, and whether the next three fixtures carry unusual risk given the current injury list. The board needs a read on the overall situation rather than a match-by-match commentary.
This is the risk reporting conversation. The board wants to know what the biggest exposures are right now, what is being done about them, and whether the position is better or worse than last quarter. A 47-row spreadsheet does not answer that question.
That picture needs to be current, consistent, and prepared without three days of manual work. The dashboards in Risk Companion surface exactly this: risks grouped by severity, measures with overdue deadlines flagged, a gap between current and target assessment showing how much progress the team's measures are actually making. The club board equivalent gets a clear answer to their question without sitting through a data preparation exercise.
The manager who walks into that room with a confident, evidence-based summary has a register that works, and the one who shuffles papers and hedges every number has a register that was built for filing.
Giving every player a role in the risk process
The best teams are well-managed because every player knows their role, knows the plan, and knows what to do when it changes. The goalkeeper knows to start the counter-press, and the striker knows which channel to exploit if they go a goal behind. Risk management works the same way: it is not a one-person job that runs through a one-person register.
Risk Companion is built on this assumption. Measures have owners, owners receive configurable alerts when a due date is approaching, and a team member responsible for a specific measure sees their task, its status, and its deadline without needing to read the whole register. The risk manager sees everything, including whose measures are on track, whose are overdue, and which risks have no measure attached at all.
The interactive risk sessions mean that a team's collective knowledge about what could go wrong goes directly into the register rather than onto a page of notes that gets typed up later. Every player's read of the game enters the system in real time.
A risk register that only one person can read, understand, or update is a single point of failure. The teams that navigate uncertainty well, whether the uncertainty is a hostile press or a regulatory change, are the ones where responsibility is distributed and the plan is shared.
The match is already in progress
World Cup 2026 will produce some of the most watched risk management in the world over the next few weeks, even if nobody calls it that. Managers will make substitutions that look obvious in hindsight and were prepared three days in advance. Contingency plans will activate smoothly or fall apart depending on how carefully they were built. Some team will reach a penalty shootout having practised for exactly this, and win it.
The parallel for your organisation is straightforward. Identify what could go wrong, assess how seriously, assign someone to own the response, build a buffer you can explain, and plan for the scenarios you hope to avoid.
The question is whether your current process is as structured as a good manager's match preparation, or whether it is closer to hoping for the best and seeing what happens.
Risk Companion's free 14-day trial builds a demo project from your own organisation's profile, so you can see the risk register, measures, and dashboards working together, the same structured approach this article describes, before you commit to anything.
Ready to improve your risk management?
See how Risk Companion can help you implement these best practices with powerful, easy-to-use tools. Sign up and we'll prepare a demo project tailored to your company.