Most organisations delivering major projects run two separate risk conversations at once. One happens inside the project, weekly and detailed. The other happens in the boardroom, quarterly and summarised. The information that would join them already exists, yet it rarely meets in one place. Connecting project risk to enterprise risk is how that gap closes, and it is the subject of this white paper from Clew. The paper examines why delivery problems so often reach executives late, and what a more connected approach looks like in practice.
Why connecting project risk to enterprise risk matters
Project teams maintain their registers diligently and the risk function reports on time, so the gap is structural rather than a failure of effort. The paper sets out why a risk that looks severe to a project can be immaterial to the organisation, while modest slippage on a smaller project can sit directly on the critical path of a commitment the executive has made. It looks at the differences in scale, language, timing and ownership that let a project report green while the objective it serves is quietly in trouble. The result is a familiar loss of enterprise risk visibility, where no single person holds the combined view across the projects that deliver an objective.
What project risk aggregation actually means
Aggregation is one of the most misunderstood ideas in project risk management. The paper is clear that it does not mean adding up ratings, counting risks or averaging scores, because an average buries the one risk that matters among the many that do not. Instead it starts from the objective and asks what collectively threatens it. The white paper walks through how project risk aggregation can surface a shared cause sitting behind several projects at once, and why that shared exposure often needs an owner with more authority than any single project manager holds.
Confidence as well as exposure
Two risks with similar potential consequence can deserve very different attention depending on how reliable the controls behind them are. The paper explains why weak confidence in a critical control is a reason to act now rather than a finding to note later, and how this connects to the board declaration on control effectiveness under Provision 29 of the 2024 UK Corporate Governance Code.
Escalation that asks for a decision
Much escalation is built on rating thresholds, which travel poorly from a project scale to an organisational one. The white paper argues for risk escalation based on consequence and authority, where an item moves up because it threatens an objective or needs a decision the project cannot make alone. It also explores what a useful escalation should carry, why speed matters more than the reporting cycle, and how culture decides whether early warning reaches the people who can act on it.
The golden thread applied to delivery
Running through the paper is the idea of a golden thread, a traceable line from a strategic objective through the risks that threaten it, the controls relied on, the indicators that show direction, and the assurance that each control can be trusted. This is where delivery confidence comes from, and where a project exposure can be recognised as a principal risk to the objective rather than a copy of each project entry.
Who This White Paper Is For
This paper is written for the people who carry accountability for outcomes and the people who advise them. Chief risk officers, heads of assurance and audit leaders will find a practical way to read project risk against objectives and to prioritise where their scarce specialist time goes. Project and programme directors, portfolio leads and senior responsible owners will gain a clearer method for connecting delivery detail to the commitments the executive and the board actually track.
