By Roma Singh
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian
Just as fresh spices elevate flavors, a well-designed risk strategy enhances organizational resilience. Both require care and attention, turning the ordinary into something truly special—creating balance and harmony in the kitchen and the boardroom alike.
An essential component in all kitchens is the Spice Rack. The humble spice rack represents the intersection of functionality, organisation, and culture in the modern kitchen. Some components are turmeric, coriander, cumin, red chillies, paprika, peppercorns, dried fenugreek leaves, basil, oregano and the list goes on..
But why am I talking spices in the world of Risk management? Why not?
Lower the spice and you lower the taste. The enterprise risk appetite is the spice threshold for the organisation. The cultural approach to risk and complexity directly influences the security architecture that organisations find most effective.
Spices lose potency over time and need regular replacement. Information Security frameworks similarly require constant refreshing. Policies become stale, risk assessments grow outdated, and compliance requirements evolve. A dusty jar of five year old paprika is as useless as an unreviewed business continuity plan from ages ago.
Experienced cooks know when to reach for cardamom or the cinnamon, understanding that each element serves specific purposes. Risk practitioners must similarly match appropriate controls to specific risks, for example: financial controls for accounting risks, cybersecurity frameworks for digital threats, and governance structures for strategic oversight. Using the wrong control is like seasoning curry with oregano : technically possible but inappropriate.
Too much salt ruins a dish; too little leaves it bland. Risk management requires similar calibration. Excessive controls stifle innovation, while insufficient oversight invites catastrophic failures. The art lies in achieving the right balance for each organisational context. Without effective governance, risk management, compliance will hit and the food goes into a waste.
Smart cooks regularly audit their spice collection, discarding expired items and restocking essentials. Effective Risk management requires identical discipline – regular control assessments, removal of obsolete procedures, and proactive identification of coverage gaps.
Just as a well-stocked, organised spice rack enables culinary creativity and consistency, a thoughtfully designed strategy provides the foundation for confident decision-making and sustainable organisational performance. Both require initial investment, ongoing maintenance, and deep understanding of how individual elements work together to create something greater than their sum.
Spices enhance a recipe and it is only as good as its ingredients. Mapping this to organisations, its how the ecosystem of people, process and technology function.
Similarly, effective governance depends on having the right talent, robust processes, and quality data. Excellent risk management cannot be built with poor data inputs, just as a great dish cannot be made with stale spices.
The spice rack relies on trusted suppliers who provide quality ingredients with proper provenance and handling. Home cooks develop relationships with reliable vendors and understand the supply chain that brings products to their kitchen. Organisations face identical challenges in cybersecurity vendor management, where third party security tools and services must undergo rigorous evaluation. Just as contaminated spices can ruin multiple dishes, compromised security vendors can introduce vulnerabilities across multiple organisational systems. The relationship between the cook and spice supplier mirrors the critical trust relationship between organisations and their cybersecurity vendors.
When a recipe is done correctly, you taste the harmony while appreciating individual elements. A mature Strategy achieves similar integration where governance, risk, compliance and audit work seamlessly together while maintaining their distinct functions and value propositions.
Both require patience, quality ingredients, proper technique, and deep understanding that shortcuts inevitably lead to disappointing results.
The sophisticated cook plans spice purchases based on anticipated cooking requirements, seasonal availability, and risk tolerance for culinary experimentation. This strategic approach mirrors how organisations should approach cybersecurity investments by assessing threat landscapes, regulatory requirements, and business objectives. Both the spice rack and risk management program require thoughtful curation that balances comprehensive coverage with practical limitations of budget, space, and complexity. The goal in each case involves creating a carefully selected collection that provides maximum protection and capability within resource constraints.
Just as Mediterranean kitchens emphasise olive oils and herbs while Asian households prioritise soy based seasonings and fermented ingredients, organisations operating in different jurisdictions must curate their cybersecurity frameworks according to regional regulatory requirements. European organisations operating under General Data Protection Regulation (GDPR) develop privacy centric security architectures, while American companies focus heavily on sector specific compliance frameworks such as Health Insurance Portability and Accountability Act (HIPAA) or Sarbanes-Oxley Act (SOX). The fundamental security principles remain consistent, but the specific implementation reflects the regulatory environment in which the organisation operates.
For me personally, a well organised spice rack brings joy to me every time I enter the kitchen. Similarly, a robust Strategy which assists in effective risk decision taking will bring joy to the Senior Management.