Why boards need to rethink physical risk

Friday, 14 August 2026

    Current

    Conventional risk registers and financial controls remain necessary, but they rarely reveal how an asset will actually perform under real-world stress.


    Presented by FM

    Most boards understand risk through an actuarial model. Historical loss data, run through a probabilistic lens, has long been the default tool for deciding what might go wrong and how likely it is. For decades, it worked well enough. 

    It’s a harder proposition today. Climate patterns are shifting, supply chains are more interconnected, and entire industries – from data centres to advanced manufacturing – are being built at a pace and scale that outstrips the historical record.

    “No-one saw certain global shocks coming from where they came,” says Andrew Stafford, Operations Manager Australia and New Zealand at FM. 

    “When the past is an increasingly unreliable guide to the future, the question for directors changes. It’s no longer just ‘how likely is this?’ It becomes, ‘if it happens, are we ready?’” he says. 

    The shift from risk prediction to risk preparedness sits at the heart of how FM works with the organisations it insures. 

    An engineering-led view of risk 

    FM doesn’t employ actuaries. Instead, the business is built around a global network of about 2000 loss prevention engineers, whose job is to physically visit client sites and assess them in detail. At each location, engineers gather around 600 data points – from finished floor levels that determine flood exposure, to the condition of back-up power systems protecting critical infrastructure. 

    That primary, ground-level data is then layered against more than 200 years of loss history, giving clients a far richer picture than a generic model could offer. 

    Crucially, it’s combined with what the client knows about its own operations. FM believes no external model has visibility into how a specific business actually depends on its physical assets. 

    “The result is a genuinely collaborative picture of vulnerability, built from real conditions rather than assumptions,” says Stafford. 

    For directors, the value shows up in a very practical question. If a critical system failed tomorrow, would the business actually respond the way it assumes it would, or does resilience currently exist only on paper? 

    Resilience by industry 

    This engineering-led lens applies wherever physical assets underpin an organisation’s ability to operate, and it plays out differently across sectors. 

    In commercial real estate, a warehousing and logistics facility illustrates the point. With a 30- to 50-year investment horizon, rising average temperatures affect worker productivity in non-air-conditioned facilities well within the life of the asset – a factor that changes where and how capital should be deployed today. 

    In mining and power generation, the questions are similar. How will fire, windstorm or flood exposure at a given site evolve over coming decades, and what does that mean for the reliability of production and earnings? 

    Data centres face their own version of this challenge. Rather than speculation about emerging risks, the practical questions are the established ones that matter to any critical infrastructure asset. Is uninterrupted power genuinely resilient? Is redundancy tested rather than assumed? How will the site perform under future climate and demand conditions? 

    “Grounding these questions in engineering data is what allows boards to make sound, forward-looking decisions about digital infrastructure investment,” says Stafford. 

    Connecting resilience to governance 

    This kind of data doesn’t just inform operational decisions. It increasingly supports the mandatory climate reporting that boards are navigating.

    “Long-run modelling, such as global flood mapping that accounts for changing land use and industrialisation, allows organisations to put genuine science behind their disclosures rather than estimates,” says Stafford. “A site that sits comfortably above today’s flood zone may not [do so] in three decades’ time. That information matters, both for asset planning and for credible, defensible reporting.” 

    From compliance to capability 

    Treating physical resilience as a strategic capability, not a compliance exercise, is perhaps the most useful mindset shift for directors to consider.

    “Conventional risk registers and financial controls remain necessary, but they rarely reveal how an asset will actually perform under real-world stress, or whether recovery systems will function when called upon,” says Stafford. 

    The organisations getting the most value from this approach are the ones willing to ask harder questions of management, not simply whether an adverse event is likely, but whether the business is genuinely prepared for its consequences. 

    “That’s often where the shift in thinking happens – when a board moves from viewing a scenario in isolation to weighing its full financial impact, including the reputational and operational costs that never show up on an insurance schedule,” he says. 

    As growth accelerates across energy, mining, manufacturing and digital infrastructure, the organisations best placed to protect their capital will be those that understand not just what could happen, but exactly how prepared they are for when it does. 

    FM Intellium is a specialised program designed to provide risk management for data centres, artificial intelligence infrastructure and power generation facilities. 

    Find out more here.

    Latest news

    This is of of your complimentary pieces of content

    This is exclusive content.

    You have reached your limit for guest contents. The content you are trying to access is exclusive for AICD members. Please become a member for unlimited access.