At 04:09 UTC on 19 July 2024, CrowdStrike pushed a routine content update to its Falcon security platform. Within minutes, blue screens of death began appearing on Windows machines across six continents. By the time most executives arrived at their desks that morning, the crisis was already global.

The numbers that followed were staggering. 8.5 million Microsoft Windows systems crashed, less than one percent of all Windows machines globally, but concentrated almost entirely in enterprises running critical infrastructure. Airlines grounded flights. Hospitals reverted to paper records. Banks froze transactions. Emergency services lost communications. Delta Air Lines alone cancelled over 7,000 flights and estimated losses of approximately $500 million. Insurers projected total losses to US Fortune 500 companies at $5.4 billion.

CrowdStrike responded quickly. CEO George Kurtz issued a public statement within hours. A preliminary Post-Incident Review was published within five days. A technical fix was distributed. But the damage, financial, reputational, and operational, was already done. Delta filed a lawsuit. Regulators opened inquiries. A class action followed.

The CrowdStrike incident was not a cyberattack. It was a software update. And yet it triggered one of the most consequential operational crises in corporate history. The lesson is not that CrowdStrike was negligent. The lesson is that no organisation, regardless of size, sophistication, or sector, is immune to a crisis arriving without warning.

"By failing to prepare, you are preparing to fail."

Benjamin Franklin

The Seven Crises That Threaten Every Organisation

PwC's Global Crisis Survey, conducted across 2,084 senior executives in 43 countries, identified seven broad categories of corporate crisis. These are not theoretical constructs. They are the documented experience of organisations that have lived through them. Nearly all business leaders, 95%, expect to face a crisis. 69% already have, within the last five years alone.

The seven types are:

Crisis Frequency: Large vs. Medium Organisations

Based on PwC Global Crisis Survey data (2019, 2023) across 2,084+ senior executives in 43 countries. Large organisations: 5,000+ employees. Medium organisations: 500–4,999 employees.

Sources: PwC Global Crisis Survey 2019; PwC Global Crisis and Resilience Survey 2023; World Economic Forum. Figures represent percentage of organisations in each category that have experienced each crisis type.

"In crisis management, be quick with the facts, slow with the blame."

Leonard Saffir, Crisis Communications Strategist

Five Ways to Prepare Before the Crisis Arrives

PwC's research is direct on one point: organisations that prepare for crises systematically outperform those that improvise. They recover faster. They lose less. They retain stakeholder trust at higher rates. And yet 29% of companies have no staff dedicated to crisis preparedness or response whatsoever.

Preparation is not a luxury. It is a competitive and governance imperative. Here are five areas where the work must happen before the crisis, not during it.

"The secret of crisis management is not good vs. bad. It is preventing the bad from getting worse."

Andy Gilman, President & CEO, Comm Core Consulting Group

The Question Is Not If. It Is When.

The CrowdStrike incident was not exceptional. It was representative. It demonstrated that crises do not announce themselves, do not respect sector boundaries, and do not give unprepared organisations the benefit of additional time. What distinguished the organisations that recovered in hours from those that took days was not luck. It was preparation.

PwC's research is unambiguous: companies with active crisis preparedness programmes suffer less financial damage, recover faster, and emerge from crises with their stakeholder relationships more intact than those that do not. The investment in preparation is not a cost. It is a form of capital preservation.

Stephen Covey framed it plainly: "If you don't choose to do it in leadership time up front, you do it in crisis management time down the road." The cost of the latter is always higher.

In July 2025, three mine workers spent more than 60 hours trapped underground after a rockfall at Newmont’s Red Chris mine in remote British Columbia, Canada.

Every worker came home.

That is the fact that matters most.

The incident happened on the morning of 22 July 2025, when a rockfall blocked access to an underground work area. Three drilling contractors working for Hy-Tech Drilling were beyond the affected area when it occurred. They moved to a refuge chamber before a second fall of rock cut off the access route completely.

Communications were lost. The route back was blocked by a large mass of fallen rock. The mine was remote. The physical conditions were dangerous.

For more than 60 hours, the three workers waited underground while rescue teams worked to reach them.

By the evening of 24 July 2025, all three had been safely brought to surface. Their employer described the moment as “euphoric.” British Columbia Premier David Eby praised “the heroic work of the rescue team.” Newmont CEO Tom Palmer said the lessons would be shared across the broader mining industry.

The rescue was not successful because the company improvised well under pressure.

It was successful because key decisions had already been made before the crisis began.

“If you don’t choose to do it in leadership time up front, you do it in crisis management time down the road.”

Stephen Covey, The 7 Habits of Highly Effective Families

What Newmont Got Right

The Red Chris rescue is worth studying because it shows what crisis preparedness looks like when the pressure is real.

The three workers had access to a refuge chamber. For non-miners, think of this as a hardened emergency shelter underground. It provides breathable air, water, food and protection when the normal way out is blocked.

That refuge chamber bought time.

Time is one of the most valuable assets in any crisis. Without it, leaders panic, teams rush and mistakes multiply. With it, the response can be methodical.

Newmont also activated its emergency protocols immediately. Operations were suspended. Specialist rescue teams were mobilised. Technology was used where human entry was too dangerous, including drones and remote-controlled equipment to assess conditions and clear rock safely.

This was not technology for technology’s sake. It was capability matched to a specific rescue problem.

The company also communicated publicly before the rescue had been completed. Newmont confirmed the incident, explained the rescue approach and committed to updates. Government, rescue teams, the company and the Tahltan Nation were visibly coordinated.

That matters.

In a crisis, silence creates space for speculation. Clear communication does not remove uncertainty, but it does reduce confusion.

“In crisis management, be quick with the facts, slow with the blame.”

Leonard Saffir, Power Public Relations (1993)

Finally, Newmont committed to learning from the incident and sharing lessons across the industry. That is the difference between treating a crisis as an event and treating it as a source of institutional learning.

The question for organisations is not whether they operate mines exactly like Red Chris. Most do not. The question is whether they have answered the same crisis questions in advance.

• Who leads?
• Who communicates?
• Who notifies families, regulators and communities?
• What equipment is already available?
• What decisions are automatic?
• What must never be left to improvisation?

Why This Matters

Mining remains a high-consequence environment. Even with significant improvements in safety performance, risks such as rockfalls, seismic events, shaft incidents and infrastructure failures cannot be eliminated entirely.

Recent incidents have shown how quickly operational disruptions can become crisis management challenges. Whether workers are trapped underground, critical infrastructure fails or rescue operations become prolonged, preparedness, communication and coordination determine how effectively organisations respond.

And the lesson extends beyond mining.

Banks, insurers, manufacturers, logistics companies, hospitals, municipalities, energy providers, ports and data centres all have their own version of the underground refuge chamber. It may be a backup power system, a cyber incident playbook, an emergency supplier arrangement or a tested evacuation plan.

The principle is simple: the thing that saves you in a crisis must exist before the crisis.

“Effective crisis management is 90% preparation and 10% execution.”

Michael Sengstack, Crisis Management Practitioner

Four Lessons for Every Organisation

“There is no worse mistake in public leadership than to hold out false hope soon to be swept away.”

Winston Churchill

The Question Leaders Should Ask Now

The Red Chris rescue is not really a story about Canada. It is a story about the difference between preparedness and hope.

The workers came home because the organisation had prepared for the possibility that something could go wrong underground.

That is the standard every high-consequence organisation should be testing itself against.

Not when the crisis arrives.

Now.

Boards that conflate risk appetite and risk tolerance make systematically different decisions from those that distinguish them.

The Boeing 737 MAX shows why the distinction matters. It was not simply a story about technical failure. It was a story about the gap between what an organisation said it stood for and what it was prepared to accept at programme level.

In 2011, Boeing faced a strategic problem. Airbus had launched the A320neo, a more fuel-efficient upgrade of its bestselling aircraft, and airlines were buying it. Boeing had two broad choices: develop a clean-sheet aircraft, or upgrade the existing 737. A new aircraft would take significantly longer and cost far more. An upgrade could be delivered faster, at lower cost, and sold to airlines as requiring minimal additional pilot training.

Boeing chose the upgrade. It would become the 737 MAX.

By the time the MAX entered service in 2017, Boeing had internal evidence that failure scenarios involving the Maneuvering Characteristics Augmentation System, known as MCAS, could be more severe than the assumptions embedded in its safety analysis and training approach. Internal simulator testing had shown that delayed pilot response to uncommanded MCAS activation could be catastrophic. Yet Boeing continued to assume that pilots would recognise and respond quickly, and it did not require pilots to be specifically trained on MCAS failure scenarios.

Lion Air Flight 610 crashed on 29 October 2018, killing 189 people. Ethiopian Airlines Flight 302 crashed on 10 March 2019, killing 157 more. The global 737 MAX fleet was grounded for 20 months. Boeing ultimately agreed to pay more than $2.5 billion in penalties, compensation and related payments. Its CEO resigned. The United States Department of Justice opened a criminal investigation.

The point is not that Boeing formally labelled the MCAS decisions as “risk appetite” and “risk tolerance” decisions. The point is that, in risk-governance terms, that is exactly what they became.

Boeing’s public identity and operating ethos rested on engineering excellence and safety. In risk-appetite terms, that implied an extremely low tolerance for catastrophic safety failure. But at programme level, specific assumptions were accepted about aircraft behaviour, pilot response, training requirements and certification. Those assumptions represented operational tolerances. They defined what the organisation was prepared to live with in practice.

That is where the gap opened.

Available investigation and litigation records indicate that critical MCAS safety information did not reach the board in a way that enabled effective challenge before the first crash. The board existed. Committees existed. Risk processes existed. But the information that mattered most did not travel with sufficient clarity from the technical level to the governance level.

That is the distinction this article is about.

Risk Appetite: The Strategic Position

Risk appetite is the amount and type of risk an organisation is willing to accept in pursuit of its objectives. It is usually set at board level and expressed in strategic terms.

It answers questions such as: are we willing to accept earnings volatility in pursuit of growth? Are we prepared to enter markets with higher regulatory uncertainty? How much operational disruption are we willing to absorb? Which risks are we prepared to take, and which are unacceptable regardless of reward?

Risk appetite is not merely a number. At its best, it is a strategic position expressed through both qualitative statements and quantitative boundaries. It tells management where the organisation is willing to play, how aggressively it is willing to pursue opportunity, and where it will not compromise.

A bank may have appetite for credit risk, but very limited appetite for liquidity risk. An insurer may have appetite for underwriting volatility, but no appetite for conduct failures. A mining company may have appetite for commodity-cycle exposure, but no appetite for preventable fatalities.

That is the function of appetite. It sets the philosophy of risk-taking.

But appetite does not govern behaviour automatically. It must be translated. That is where tolerance matters.

Risk Tolerance: The Operational Boundary

Risk tolerance is the acceptable level of variation from a specific objective, risk or control requirement. It is more granular than appetite. It is where the board’s philosophy becomes an operational boundary.

Tolerance may be expressed as a number, threshold, trigger, limit, control requirement, escalation point or prohibited condition.

A hospital system may have a risk appetite statement that says it will not accept risks that compromise patient safety. Its tolerance for a specific procedure might include infection-rate thresholds, minimum staffing levels, escalation requirements and conditions under which surgery must not proceed. A bank may state low appetite for regulatory breaches. Its tolerance position may define reporting deadlines, breach escalation thresholds, remediation timelines and unacceptable repeat findings. A logistics company may prioritise driver safety. Its tolerance framework should define maximum driving hours, vehicle-maintenance limits, fatigue triggers and non-negotiable stop-work conditions.

Appetite tells the organisation what it stands for. Tolerance tells people what to do when trade-offs appear.

The danger is that organisations often state appetite at the top, but set tolerances far below the boardroom. Product teams, engineers, underwriters, traders, claims teams, procurement teams and project managers all make tolerance decisions. Some are formal. Many are informal. Some are documented. Many are embedded in operating practice.

Over time, those decisions can drift away from the appetite statement without anyone making a single dramatic decision to allow it. That is where risk accumulates.

A Simple Analogy

Think about driving.

Your appetite for road risk might be: I drive safely and do not take unnecessary risks. That is your philosophy. Your tolerance is how fast you actually drive on a specific road in specific conditions. If the speed limit is 120km/h and you drive at 130km/h on a clear day, you have made a tolerance decision that deviates from your appetite statement. If you drive at 150km/h in rain with worn tyres, the deviation has become dangerous.

Your appetite statement has not changed. Your actual tolerance has.

The gap between the two is where risk lives.

Organisations do this constantly. They state their appetite in governance documents, board packs and strategy presentations. Their actual tolerances are set through pricing decisions, project deadlines, control exceptions, resourcing constraints, policy waivers, technology workarounds and escalation failures.

The organisation may still say the right thing. The question is whether it is accepting something different.

Why Traditional Risk Reporting Often Misses the Gap

The Boeing case raises a second question. If the board existed, committees met, risk processes operated and reports were produced, why did the board not have the information it needed?

Part of the answer lies in how risk is reported. Traditional board risk reporting often relies on quarterly heat maps, top-ten risk lists and traffic-light dashboards. These tools are not useless. They provide structure. They create a common language. They help boards orient themselves.

But they are insufficient when used as the primary instrument of risk intelligence.

The issue is not whether heat maps should disappear. The issue is whether they are being asked to do more than they can do.

What Better Board Risk Reporting Looks Like

Effective board risk reporting should do five things.

The Practitioner’s Responsibility

There is a version of this debate that places the burden entirely on the board. Boards should ask better questions. They should demand more transparency. They should challenge management harder.

That is true, but incomplete.

Risk practitioners carry an equal responsibility. Their job is not only to assess risk. It is to convert technical risk work into decision-useful intelligence.

A technically excellent risk register that lands in the boardroom as a dense spreadsheet has not completed the job. A simplified dashboard that removes the tolerance analysis has also not completed the job.

The task is to do both: preserve rigour and create clarity. That requires the practitioner to think like a strategist, communicate like an executive, and still work with the discipline of a technical specialist.

Without that translation, risk management becomes administrative rather than strategic.

The Standard Worth Holding

Risk appetite and risk tolerance are not administrative constructs. They are the operating system of sound risk governance.

When they are clearly defined, properly distinguished and honestly reported, boards can make better decisions. Organisations can take risk deliberately rather than accidentally. The gap between what an organisation says it stands for and what it actually accepts can be narrowed.

Boeing’s failure was not that it lacked engineers, committees, reports or processes. It was that critical safety information did not reach the governance level with the clarity required for effective challenge. The organisation’s public commitment to safety and the operational tolerances accepted within the MAX programme moved too far apart.

That is the lesson.

The question for every board and every risk practitioner is not whether the organisation has a risk framework. Most organisations do.

The question is whether the framework is doing what it is supposed to do.

If not, the organisation may not have a risk-governance framework.

It may only have risk-governance theatre.

The backlash against ESG is real. Some of it is deserved.

But it is not really a backlash against sustainability, responsible governance, climate risk management, supply-chain resilience, fair labour practices, or ethical conduct. It is a backlash against performative ESG: the version that produces glossy reports, vague targets, weak ownership, and very little operational change.

That distinction matters.

Because the organisations that built sustainability into their operating architecture are not retreating. They are compounding.

In 2011, Patagonia placed a full-page advertisement in The New York Times on Black Friday. It showed one of its most popular fleece jackets. The headline read: “Don’t Buy This Jacket.”

The copy explained the environmental cost of producing the garment: 135 litres of water, 20 pounds of carbon dioxide, and waste equivalent to two-thirds of the jacket’s weight. It asked customers to think before buying, repair before replacing, and reconsider before consuming.

Most companies would have considered that commercially suicidal.

Patagonia ran it anyway.

The campaign did not destroy the business. Patagonia’s sales grew in the period that followed. In 2022, founder Yvon Chouinard transferred ownership of the company, valued at approximately $3 billion, to the Patagonia Purpose Trust and the Holdfast Collective, with the declaration: “Earth is now our only shareholder.” Patagonia remains a private company, but it is widely regarded as a billion-dollar business whose reputation is inseparable from the credibility of its environmental commitments.

Patagonia did not succeed because it published a sustainability report. It succeeded because sustainability was not a layer added to the business. It was part of the architecture of the business.

That is the point many organisations miss.

ESG fails when it is treated as a communications exercise. It becomes credible only when it changes how the organisation allocates capital, manages risk, buys from suppliers, designs products, measures performance, rewards executives, and governs itself.

The problem is not ESG. The problem is the gap between strategy and deployment.

“ESG is not about philanthropy. It is about risk management.”

Mark Carney, Former Governor, Bank of England and Bank of Canada

Let’s Address the Scepticism Directly

There is a version of ESG that deserves scepticism.

It is the version that announces net-zero commitments without a credible transition plan. The version that produces sustainability reports filled with aspiration but no deployment roadmap. The version that appoints a sustainability officer, gives them no budget, no authority, no board access, and then measures success by the thickness of the annual report.

When this is dishonest, we call it greenwashing. When organisations become nervous about scrutiny and stop communicating their sustainability work altogether, we call it greenhushing.

The examples are not theoretical. Deutsche Bank’s asset management arm, DWS, was fined €25 million by German prosecutors in April 2025 after an investigation into misleading statements about its ESG credentials. HSBC exited the Net-Zero Banking Alliance in 2025. Global sustainable funds recorded outflows of more than $8 billion in the first quarter of 2025, with US investors accounting for most of the withdrawals.

So yes, the backlash is real.

But the backlash against performative ESG is not an argument against substantive ESG. It is an argument for the difference between the two.

The organisations retreating are often retreating from the label, the marketing, or the commitments they never had the operating model to deliver. The organisations that embedded sustainability into governance, risk management, procurement, capital allocation and performance management are not asking whether ESG is fashionable. They are asking whether the business is resilient.

“When sustainability is viewed as being a matter of survival for your business, you can create massive change.”

Cameron Sinclair, Architect and CEO, Worldchanging Institute

The Implementation Gap Is the Real Problem

The strongest evidence against performative ESG is not ideological. It is operational.

A 2025 article in Frontiers in Sustainability, citing an early assessment of 312 EU companies across 18 sectors, reported that only 37% had fully established double materiality assessment processes by Q4 2024. A further 54% were only partially prepared.

EY’s 2025 Global Climate Action Barometer found that 92% of companies analysed assess the qualitative or quantitative impact of physical climate risks. But only 44% reported having adaptation measures in place.

Read those numbers again.

Almost everyone is assessing the risk. Fewer than half are adapting to it.

That is not a knowledge problem. It is a deployment problem.

This is where the board-to-operations breakdown lives. At board level, commitments are made in strategic language: reduce Scope 1 and 2 emissions, improve gender representation, strengthen supplier standards, manage climate risk, improve disclosure quality. These commitments land in the annual report and investor presentation.

But at operational level, the procurement team is still measured primarily on cost. Finance is still allocating capital without a sustainability lens. HR is still managing incentives around traditional performance metrics. Risk teams are identifying ESG exposures, but line management is not always required to own the mitigation.

The ESG strategy and the operating model run on parallel tracks. They speak to each other in reporting season, but not in the daily machinery of the business.

That is not a failure of intent. It is a failure of architecture.

“Ambition, authenticity and alignment. Ambitiousness in ESG strategy unlocks value and innovation. Authenticity means putting it at the core of the business rather than treating it as a peripheral issue. Alignment means connecting the overall strategy to everything: hiring, remuneration, procurement.”

Michele Lemmens, Head of Business Sustainability, Tata Consultancy Services

What Practical ESG Actually Looks Like

Practical ESG is not a framework document. It is not an ISSB disclosure, a GRI index, or a polished sustainability report. Those are outputs. Practical ESG is the operating discipline that produces outputs worth disclosing.

It has five characteristics.

“Many business leaders are seeing the relationship between long-term success and sustainability, and that is very heartening.”

Jacqueline Novogratz, Founder and CEO, Acumen

The Board’s Role: Strategy, Not Ceremony

The board’s role is not to applaud the sustainability report once a year. It is to govern the architecture.

That means the board should approve the sustainability strategy and deployment roadmap, not just the disclosure. It should review material sustainability risks in the same governance cycle as financial, operational and strategic risks. It should challenge management on greenwashing risk, data quality, capital allocation and execution.

It should also ensure that sustainability has the resources required to move from ambition to implementation.

The serious board question is not: “Do we have an ESG report?”

It is: “Have we embedded the material ESG issues into how this organisation is governed, managed and measured?”

What the Sceptics Get Right

The ESG sceptics are not wrong about everything.

They are right that some ESG activity has been ideological, performative and disconnected from financial reality. They are right that ESG reporting has become complex. The proliferation of GRI, ISSB, TCFD, CSRD, ESRS, SFDR and other frameworks has created a real compliance burden. The EU’s 2025 Omnibus simplification package acknowledged this by proposing changes to sustainability reporting and due-diligence rules, targeting a 25% reduction in administrative burdens for companies and 35% for SMEs.

They are also right that ESG cannot be copied and pasted from large corporates into small and medium enterprises. A 200-person company does not need the same architecture as a multinational bank or mining house.

But the sceptics are wrong when they conclude that ESG itself is the problem.

The physical risks of climate change are already affecting insurance markets, infrastructure planning, agriculture and supply chains. Poor labour practices can become disruption, litigation, reputational damage and regulatory enforcement. Weak governance can become fraud, misconduct, capital destruction and loss of trust. Supplier failures can become operational failures.

These are not abstract moral concerns. They are business risks.

The answer to weak ESG is not to abandon ESG. It is to make it practical, material, governed and operational.

The Practical Test

Any organisation reviewing its ESG posture should ask four questions.

If the answer to all four is yes, the ESG programme is becoming operational. If the answer to any of them is no, the gap between ESG commitment and ESG architecture is where the risk lives.

Patagonia did not answer these questions perfectly on day one. It built credibility over years of operational decisions. The “Don’t Buy This Jacket” advertisement was not the strategy. It was a signal that the strategy was real.

The question is not whether organisations should have a sustainability strategy. The market, the regulatory environment and the operating context have already answered that.

The real question is whether the strategy is architecture or aspiration.

One of those protects the organisation. The other only protects the narrative.

Three shocks are converging on the South African food basket.

Most people are seeing only the first one. They think this is about fuel prices. More specifically, they think it is about what motorists pay at the pump.

But for food security, the more important number is diesel.

In April 2026, South Africa’s household food basket rose by 2.3% in a single month. That was R123.56 more in one month. Painful. Visible. Real.

But it may also be the least important signal.

Behind that number sits a convergence of three supply-side shocks: fuel and logistics, fertiliser, and weather. Each is material on its own. Together, they create a more dangerous 2027 risk environment.

South Africa has one important advantage right now: the Crop Estimates Committee’s April 2026 production forecast points to a strong 2025/26 summer grain and oilseed harvest. The stores are not empty. That matters.

But abundance should not be mistaken for safety.

A full silo is not a strategy. It is a window.

“Risk comes from not knowing what you’re doing.”

Warren Buffett, Chairman and CEO, Berkshire Hathaway

The Risk Is Convergence, Not Inflation

The better framing is not inflation. It is convergence.

The three shocks are not arriving at exactly the same time. They are arriving close enough that the buffer between them is thin.

Fuel affects the cost of producing, moving and preserving food now. Fertiliser affects the cost and viability of planting later in 2026. Weather affects the yield of what is harvested in 2027.

That is the structure of the risk.

“We do not rise to the level of our expectations. We fall to the level of our preparation.”

Archilochus, Greek Poet, 7th century BC

The Household Baseline Is Already Fragile

This is not only a 2027 problem. The household baseline is already under pressure.

The Pietermaritzburg Economic Justice and Dignity Group’s Household Affordability Index is not official inflation data. It is a widely cited civil-society affordability measure focused on the lived cost of a basic basket for low-income households. Read alongside Stats SA’s CPI data and agricultural-market analysis, it gives a sharper view of household stress than headline inflation alone.

The May 2026 Household Affordability Index recorded the household food basket at R5,479.26. The National Minimum Wage for a 20-working-day month yields R4,836.80.

That is already a R642.46 shortfall before rent, transport, electricity, school costs or debt service.

After PMBEJD’s estimated transport and electricity costs of R2,781.85 are deducted, a minimum-wage worker has R2,054.95 left. The basic nutritional food basket for a family of four costs R3,795.23. That leaves a shortfall of R1,740.28, or 45.9%.

This is the baseline against which the next shocks arrive.

It is possible to have record harvests in the national system and record hunger in households. That is the uncomfortable truth of food security. Availability is not the same as affordability.

The 2.9% food and non-alcoholic beverages inflation headline risks understating the lived reality. Meat inflation was still 9.4% year-on-year in April 2026. Electricity and transport are already crowding out food spending for low-income households.

The country is not entering the 2027 risk window from a position of household strength.

“Unprecedented events occur regularly. Be prepared.”

Seth Klarman, Founder and CEO, Baupost Group

The Monetary Shock Has Now Joined the Picture

South Africa entered 2026 with headline inflation at 3%, a 21-year low, and the SARB on an easing cycle. That easing cycle is now under pressure.

At its May 2026 meeting, the SARB raised the repo rate by 25 basis points to 7.00%, effective 29 May 2026, with the prime lending rate moving to 10.50%. The Bank raised its 2026 inflation forecast to 4.4% and modelled risk scenarios involving a prolonged Middle East crisis, higher oil and food prices, a weaker rand, an El Niño event, and non-linear inflation effects.

This matters because food insecurity is not only a food-price problem. It is a household cash-flow problem.

For low-income households, higher rates do not arrive only through bond repayments. They arrive through the cost of credit used to survive lean months, transport finance, informal lending, store accounts, and debt servicing.

The deficit already exists. Higher rates harden it.

What the State Should Do While the Shield Holds

South Africa’s strong 2025/26 summer grain and oilseed harvest is keeping physical scarcity at bay. That is precisely why the next few months matter.

“The time to repair the roof is when the sun is shining.”

John F. Kennedy, Address to a Joint Session of Congress, 1962

What Organisations Should Do

This is not only a government issue. The same convergence shaping food security is also shaping the operating environment for South African organisations.

The Timeless Lesson

The data points will move. Fuel prices will change. Fertiliser prices will adjust. El Niño forecasts will be updated. The El Niño may be milder or more severe than current probabilities suggest.

But the structure of the risk will remain.

Compound shocks are harder to manage than single shocks because they arrive with different leads and lags. They interact in non-linear ways. They consume the response capacity that would otherwise be available for each event in isolation.

The 2015/16 drought did not arrive with the same combination of global fertiliser stress, elevated fuel volatility, household fragility, and monetary tightening. The buffer was thicker then.

In 2026, the buffer is thinner.

The minimum-wage household is already in deficit. The supply chain has already absorbed a fuel shock. The fertiliser window is narrowing. The probability of El Niño has risen. And the next harvest depends on decisions being made now.

South Africa has a strong harvest.

That is not the end of the story.

It is the opportunity in the story.

A shield is most useful before the next blow lands.

The question is whether we use it.

On 17 April 2025, attackers posing as a Marks & Spencer employee contacted a third-party IT helpdesk. They had done their preparation. They knew enough about the organisation, the people, and the processes to be convincing. The helpdesk agent, operating to a scripted process, reset an account password. The attacker now had a foothold inside M&S’s systems.

M&S detected the intrusion two days later. By then, the damage was already seeded.

The attackers, later identified as the Scattered Spider collective deploying DragonForce ransomware, had stolen the Windows domain’s NTDS.dit file as early as February 2025, cracking password hashes for all domain users and patiently building access over weeks. In April they struck. Virtual machines were encrypted. Stock ordering and fulfilment systems went down. Online clothing orders were suspended for 46 days. Food stores ran short of fresh products. Customers could not use gift cards. M&S’s chairman Archie Norman testified before the UK Parliament’s Business and Trade Committee in July: the entry was a ‘sophisticated impersonation’ and ‘part of the point of entry also involved a third party.’

The financial impact: £300 million in lost operating profit. The reputational impact, the humiliation of a 141-year-old retail institution reverting to pen-and-paper stock management, cannot be offset by insurance.

M&S had a vendor management programme. It had a decade-long outsourcing relationship with Tata Consultancy Services, renewed in 2023 for approximately $1 billion. The helpdesk function had been operating for years without incident. By every standard compliance measure, the relationship was managed.

The question the M&S incident forces is not whether the vendor was audited. It is whether the governance framework governing that outsourced helpdesk function was designed to prevent exactly this. Whether the social engineering risk through a third-party access point was identified, rated, and controlled to a specific tolerance. Whether the helpdesk agents handling M&S credentials were trained to a standard that M&S had defined and verified. Whether the right to set and audit those standards was written into the contract.

That is not a compliance question. That is a framework question.

“It’s fair to say that everybody at M&S experienced it. We’re still in rebuild mode and will be for some time to come.”

Archie Norman, Chairman, Marks & Spencer, testimony to UK Parliament, July 2025

The Distinction That Changes Everything

When most organisations talk about managing third-party risk, they mean compliance management. Annual questionnaires. Certification checks. Contractual review. These are compliance checks. They tell you what the vendor says about itself at a point in time.

A compliance audit asks: is this vendor doing what it said it would do? Necessary. Not sufficient.

A framework audit asks: is the governance architecture we have built around this outsourced relationship adequate for the exposure it creates? Are our risk appetite and tolerance statements specific enough to be enforced? Are the controls proportionate to the criticality of what we have outsourced? Have we tested what happens if this vendor fails?

M&S had passed compliance checks. The framework governing the specific risk of social engineering through a third-party helpdesk was not designed to stop what happened. The attackers did not defeat the technology. They defeated the process. And that process, including what standard the helpdesk operated to, what authentication was required before a password reset, sat inside the third party’s operation, outside M&S’s direct control.

That is the governance gap this article is about.

“Your vendors’ problems become your problems, often with financial consequences that show up directly on the balance sheet.”

Safe Security, 2026 Guide to Third-Party Risk Management

JLR: The Same Model. A Larger Number.

Five months after M&S, in late August 2025, Jaguar Land Rover experienced a cyberattack that shut down production at factories across the UK. By 1 September, all production had paused. The pause extended to 1 October. The Cyber Monitoring Centre estimated total economic damage at £1.9 billion, making it the most expensive security breach in British history.

The attack vector bore striking similarity to M&S: social engineering, credential abuse, a third-party access point. The same hacking collective, Scattered Spider, claimed responsibility. And JLR had a significant technology outsourcing relationship with TCS, expanded in late 2023 in a deal worth more than £800 million.

TCS manages IT for more than 200 UK-based companies. M&S, JLR, and Co-op, also attacked in the same wave, were all clients. Three organisations. Same outsourcing model. Same period. Same threat actor. The concentration risk of a single IT outsourcing provider managing access infrastructure for hundreds of enterprises is a systemic governance vulnerability. No individual compliance check on any one of those organisations would have surfaced it.

Two incidents. £2.2 billion in estimated combined economic damage. One shared structural lesson: when you outsource access to your systems, you must govern that access with the same rigour you apply to your own employees.

“Outsourcing critical IT systems without robust oversight introduces major breach risk, especially during periods of low vigilance.”

Strobes Security, Top Data Breaches of May 2025

The Six Risk Categories That Demand Explicit Governance

Third-party outsourcing creates risk across six distinct categories. Each requires an explicit appetite statement and measurable tolerance thresholds.

Defining Appetite and Tolerance for Outsourced Services

Most organisations have a risk appetite statement that says something like: we do not accept risks that compromise the confidentiality or availability of critical systems. That is philosophy. It is not governance.

Governance requires that philosophy to be translated into three operational layers.

Service criticality tiering. Assign every vendor to Tier 1 (critical), Tier 2 (significant), or Tier 3 (standard) based on their access to sensitive data, their role in critical processes, and the operational consequence of their failure. A helpdesk provider with the ability to reset credentials for all domain users is a Tier 1 vendor. M&S’s helpdesk was a Tier 1 function. Whether it was governed as one is the question the incident raises.

Risk category tolerance thresholds. For each of the six categories above, define a specific measurable threshold. For cybersecurity risk at a Tier 1 vendor: all agents handling credential resets must operate under a defined verification protocol reviewed and approved by the client organisation, not the vendor. For concentration risk: no single vendor may be the sole provider of a credential-management function without a documented and tested fallback process.

Contractual translation. Tolerance thresholds that exist only in governance documents are not enforceable. They must be written into contracts: right-to-audit clauses, incident notification timelines, minimum training standards for agents handling client-critical functions, sub-contractor disclosure obligations, and defined exit provisions. A vendor that will not accept your tolerance conditions as contractual terms is a vendor whose risk profile exceeds your appetite.

“Third-party risk is not a procurement problem or a compliance problem. It is a governance problem. And governance problems have governance solutions.”

Diligent, Third-Party Risk Management Guide, 2025

How to Audit Third Parties: Framework First, Compliance Second

“Review third-party management frameworks regularly and after significant events or incidents, in order to improve the effectiveness of third-party risk controls.”

FCA, Observations and lessons learnt from the July 2024 global IT incident

Outsourced. Not Offloaded.

M&S had a vendor management programme. It had compliance checks. The attackers did not find a technical vulnerability in a poorly maintained system. They found a process gap in a helpdesk operating to its own standards rather than to standards defined, contractualised, and audited by its client.

JLR had outsourced IT management to the same provider. Co-op had done the same. Three attacks in the same wave. The same threat actor. The same social engineering methodology. The case for systemic governance review has never been more urgent or more clearly illustrated.

Outsourcing transfers the function. It does not transfer the risk. That risk stays with the organisation whose name is on the building, whose customers are affected, whose chairman sits before parliamentary committees explaining what happened.

Compliance checks confirm the vendor is doing what it said it would do.

Framework audits confirm that what the vendor said it would do is actually sufficient.

M&S had the former. The incident revealed it did not have enough of the latter.

Lewis Hamilton’s first win for Ferrari was not only a story about speed. It was a story about confidence, calibration, and the narrow gap between capability and performance.

On 14 June 2026, after 66 laps at the Circuit de Barcelona-Catalunya, Hamilton crossed the line first. His first Grand Prix victory in nearly two years. Ferrari’s first win of the 2026 season. The first all-British Formula 1 podium since 1968, with George Russell second and Lando Norris third.

The obvious story was the comeback: a 41-year-old seven-time world champion, in a new team, in a new car, in a new regulatory era, winning again at one of Formula 1’s most demanding circuits.

But the more useful story sits beneath the result.

Hamilton did not win simply because Ferrari had the fastest car. Ferrari’s race strategy mattered. Tyres mattered. The Virtual Safety Car mattered. Mercedes’ tyre degradation mattered. Execution mattered.

But one technical detail gives us the better lesson: Hamilton’s brake-disc switch.

By Barcelona, Hamilton was running a Carbone Industrie brake configuration on his Ferrari, moving away from the Brembo configuration historically associated with Ferrari. It was not a simple case of one supplier being better than another. Both Brembo and Carbone Industrie produce world-class Formula 1 braking technology.

The issue was more subtle. It was about feel.

Hamilton had spent years driving with Carbone Industrie brakes during his Mercedes career. He understood their characteristics. He knew the bite point. He knew how they behaved at the limit. He knew how much confidence they gave him under heavy braking.

That mattered because in Formula 1, confidence is performance.

A driver who trusts the brakes can brake later, carry more speed into the corner, rotate the car with greater precision, and get back on the throttle earlier. A driver who does not trust the brakes leaves a margin. That margin may be invisible from the outside, but it shows up on the stopwatch every lap.

Leclerc’s experience underlined the point. After Monaco, he had described his brake situation as ‘borderline dangerous’, while Brembo pushed back against the conclusion. Ahead of Barcelona, Leclerc tested Hamilton’s Carbone Industrie direction. But his weekend still showed the nuance: changing the component is not the same as immediately unlocking confidence. A new tool without accumulated feel can create its own adjustment risk.

That is why the lesson is not that Carbone Industrie was superior to Brembo.

The lesson is that the fastest driver is often the one who has the framework, temperament, confidence, and skill to slow down at the most critical moment.

The fastest car is not merely the one with the most horsepower. It is the one whose driver can trust it enough to brake late without losing control.

Risk management works the same way.

Speed Is Created in the Braking Zone

This sounds counterintuitive until you think about it carefully.

In Formula 1, speed is not only built on the straights. Every car accelerates. Every car produces downforce. Every car reaches extraordinary speeds. The separation often happens in the braking zones.

That is where the driver decides how late to brake, how much speed to carry, how much grip to trust, and how much risk to take. Brake too early, and time disappears. Brake too late, and control disappears. The art is not avoiding the brake. The art is applying it at precisely the right moment.

High performance is not the absence of restraint. It is the disciplined ability to apply restraint late, precisely, and with confidence.

That is the risk management lesson.

The best organisations are not the ones that move fast because they have weak controls. They are the ones that move fast because their controls are trusted, calibrated, and understood. They do not treat risk management as a handbrake. They treat it as the braking system that allows them to carry speed safely.

A board that trusts its risk intelligence can make sharper decisions. An executive team that understands its risk appetite can commit with more confidence. A business that knows where its control limits sit can move faster than one that is constantly second-guessing itself.

The difference is not bravery. It is calibration.

The Difference Between Having Brakes and Trusting Them

Most organisations have risk frameworks.

They have risk registers. Heat maps. Appetite statements. Tolerance thresholds. Committee packs. Escalation protocols. Control attestations. Assurance plans.

On paper, the car has brakes.

The real question is whether leadership trusts them.

A risk framework that the board does not understand is not a brake. It is a dashboard light. A risk appetite statement that is never used in decision-making is not governance. It is decoration. A risk report that arrives after the decision has already been made is not oversight. It is historical commentary.

The issue is not whether the organisation has a risk management system. Most do. The issue is whether that system is calibrated to the organisation’s actual operating context, decision speed, leadership style, and strategic ambition.

A technically complete framework can still fail if the people using it do not trust the feel of it.

That is the Hamilton point. The brake-disc switch mattered because it gave him confidence at the point of maximum consequence. It allowed him to close the gap between what the car could do and what he was willing to attempt.

In governance, that same gap is everywhere. It is the gap between what the board says its risk appetite is and what management actually does. It is the gap between risk reports and business decisions. It is the gap between control design and control reality. It is the gap between capability and confidence.

And in that gap, risk accumulates.

Decorative Risk Management Brakes Too Early

When leaders do not trust the risk framework, they compensate in one of two ways.

Some become reckless. They ignore the framework entirely and rely on instinct. Others become overly cautious. They brake too early. Both are failures of risk governance.

The reckless organisation treats risk management as bureaucracy. It moves fast until it reaches a corner it cannot take. The overly cautious organisation treats uncertainty as danger. It slows down long before the decision requires it. It survives, but it leaves performance on the table.

Neither outcome reflects mature risk management.

Useful risk management gives leadership the confidence to act. Not blindly. Not slowly. Precisely. It helps decision-makers understand where the edge is. It distinguishes between risks that must be avoided, risks that must be mitigated, risks that must be transferred, and risks that must be taken deliberately because they are inseparable from strategy.

That is what good brakes do. They do not prevent speed. They make speed usable.

The Framework Must Fit the Driver

There is another important lesson in the brake-disc story.

A tool that works for one driver does not automatically work for another. Hamilton’s preference for Carbone Industrie mattered because it aligned with his accumulated experience. He knew how to use that system. He knew how it behaved under pressure. He knew what the feedback meant.

Leclerc testing the same direction did not instantly create the same result. That is not a contradiction. It is the point.

Frameworks do not operate in isolation. They operate through people.

A risk methodology imported from another organisation may be technically sound and still fail. A reporting template used successfully by a peer company may not work in your boardroom. A consultant’s framework may look impressive, but if it does not match your organisation’s language, risk maturity, operating rhythm, and decision culture, it will not create confidence.

It may create compliance. It may not create better decisions.

This is why risk practitioners should be careful with borrowed frameworks. The question is not whether the framework is elegant. The question is whether it helps your leadership team make better decisions under uncertainty. If the answer is not clearly yes, the framework is not yet doing its job.

Five Implications for Risk Practitioners

The Standard Worth Pursuing

Lewis Hamilton’s Barcelona win was not a simple brake-disc story. It was the product of driver craft, Ferrari strategy, race timing, tyre execution, and a technical configuration that helped him trust the car where trust matters most.

That is what makes the analogy powerful.

The fastest driver is not the one who refuses to slow down. The fastest driver is the one who knows exactly when to slow down, how late to leave it, and how much control the system will give back.

The same is true for organisations. The best risk frameworks do not slow the business unnecessarily. They give the business the confidence to move at the limit of its capability without tipping into recklessness. They help leaders know when to accelerate, when to hold position, and when to brake.

That is the standard worth pursuing.

Not more risk reports. Not prettier dashboards. Not heavier governance.

A risk system that leaders trust when the corner arrives.

Because in Formula 1, as in business, speed without control is not performance. It is exposure.

And the fastest car on race day is often the one whose driver trusts the brakes.