Challenging assumptions: how Roche and Tetra Pak are rethinking risk

Risk professionals have long aspired to be seen as strategic partners to the business. But too often, traditional risk reports simply restate what the business already knows.

In a session at Risk-!n 2025, two senior risk leaders, Moritz Bachmann of Roche and Petko Nedev of Tetra Pak, shared how scenario planning is helping risk managers break free from regulatory reporting cycles and become real agents of strategic preparedness.

Beyond the risk matrix

For Bachmann, medical compliance risk and opportunity leader at Roche, the key insight is that most risk reports offer little in the way of surprise. “Very often when I see risk reports,” he said, “they are just another way of presenting things that everybody already knows.”

Instead, he challenged risk professionals to ask themselves a new question: what are we teaching the board that they don’t already know? To help answer that, Roche is replacing traditional risk categories with language that speaks to business leaders. “When I talk about risk, I don’t use the word risk anymore. I use turbulences and certainties, novelties or ambiguities. And this works very well when you have conversations with leaders, because you don’t have to explain.”

Bachmann also emphasised the importance of time horizon in risk thinking. When he joined Roche, risk assessments focused on a three- to five-year outlook, too narrow for an organisation with ten-year strategies and twenty-year patent lifecycles. Using climate scenarios as an example, he illustrated how a short-term view might prioritise rising temperatures and flooding, while a 50-year scenario could instead suggest the collapse of the Gulf Stream and a dramatic drop in UK temperatures. These longer-term perspectives, he argued, are crucial to shaping business strategy, insurance planning and resilience.

The goal, Bachmann stressed, is not just to catalogue risk, but to change the way senior leaders think. “I try to measure my success as a risk manager in the number of decisions that are taken after a risk presentation. If there is no action… maybe I just presented something everybody was already aware of.”

His team now hosts annual scenario workshops to identify emerging trends, which feed into quarterly top-five risk reviews. The focus is no longer on managing hundreds of minor risks, but on creating space for meaningful, forward-looking conversations.

Connecting strategy and risk

Tetra Pak has also overhauled its risk framework to better connect with strategy. Petko Nedev, director, corporate risk management, explained that while the language of operational and strategic risk is familiar, the real change was structural: “Previously we were looking at operational, strategic and emerging risks… but we were struggling to actually make the link between those types of risks and then specific business processes and decision making that we would support.”

Strategic risks are now tightly interwoven with the company’s 2030 strategy, which is built on five megatrends, including sustainability, technological development and geopolitical shifts. Scenario planning is then used to challenge and monitor the assumptions behind that strategy. “We looked at the world in 2030 from 12 different lenses… geopolitics… macroeconomics, the future of the food industry, the future of the retail industry, and so on. And for each of those lenses, we develop assumptions. And ultimately we prioritised this… in five megatrends that were the basis of our strategy.”

This scenario-based planning is fully embedded into how the company builds its rolling three-year plan. “All the assessments from this process actually feed into the financial projections,” Nedev said. “So basically whatever the finance team does in terms of sensitivity analysis, it’s mostly based on the risk assessment… if we see those indicators moving, we would also refine our action plans.”

From scenarios to action

To ensure these scenarios drive change, Tetra Pak has introduced playbooks for each key risk, with defined actions for the base case, alternatives and outliers. They track qualitative and quantitative signposts, such as the market share of foreign versus local brands in key regions, to know when a shift is occurring.

Relevance, said Nedev, is what ensures executive buy-in. “The mitigations are actually part of the operational plan. They’re part of the KPIs for the business units. And they’re completely integrated into their performance management.”

Both speakers emphasised that the ultimate test is whether the risk function is invited to shape strategic discussions, not merely observe them. “We should speak less the language of risk management,” said Nedev, “and more the language of the processes that we support.”

At Tetra Pak, that shift has enabled deep collaboration between risk and strategy teams. “With my colleagues from strategic planning, we actually go to the executive leadership team together. Sometimes I join their sessions, sometimes they join the risk committee… we have one message to the executive team.”

Bachmann often uses an analogy to explain the distinction between operational and strategic risk. He compares traditional risk functions to engineers examining a car in detail, checking tyres, fixing components, and scanning for faults. “They are looking at issues… what could go wrong… what keeps you awake at night,” he said. “And there’s one engineer who is looking at… the road. That’s the strategic risk manager.”