The Boiling Frog: How Undefined Risk Appetite Quietly Kills Strategic Agility

By Erin Sedor | Black Fox Strategy

You know the story. Drop a frog into boiling water and it jumps out immediately. But place that same frog in tepid water and slowly raise the temperature, and it stays put. It acclimates. It adjusts. It tells itself the water is fine.

Until it isn’t.

I use this analogy a lot in my work because it is one of the most accurate descriptions of what happens inside organizations that fail to define risk appetite as part of their strategic planning process. Not because leaders are careless or unintelligent. But because the human brain is wired to normalize incremental change—especially when each individual step seems small, reasonable, and survivable.

And that’s exactly how strategies silently overshoot every boundary that was never set.

The Slow Creep Nobody Notices

Here’s how it plays out in the real world. A leadership team approves a strategic initiative with a general sense of the resources they’re willing to spend, invest and commit. Not a defined threshold—a feeling. A vibe. Maybe a rough number discussed once in a planning session and never revisited.

Then execution begins. A scope adjustment here. An unexpected cost there. A “small” additional investment to stay on timeline. Each decision, in isolation, feels perfectly rational. The increments are manageable. The justification is sound. Nobody flags it because nobody has a clear boundary against which to measure it.

Six months later, the organization has committed three times what anyone would have agreed to at the outset—and the most dangerous part is that no single decision felt like the one that crossed the line. Because there was no line.

This doesn’t just happen with money. It happens with speed—how fast you push growth before quality erodes. It happens with change—how much organizational disruption you absorb before the culture buckles. It happens with scope—how many initiatives you layer on before the team can’t execute any of them well.

The temperature rises. The frog adjusts. And nobody jumps.

There’s a Name for This

Psychologists call it Normalcy Bias—the tendency to underestimate the likelihood and impact of a disruption because we assume the current state of affairs will continue. It’s the cognitive filter that tells us “this is fine” even when the evidence is building that it isn’t. In an organizational setting, Normalcy Bias is why teams don’t escalate concerns about mounting costs, accelerating timelines, or compounding complexity until the damage is already done.

It works hand-in-hand with another pattern I see constantly: Omission Bias—the tendency to judge harmful actions as worse than equally harmful inactions. Leaders will agonize over a bold decision to cut a program or redirect resources, but the slow bleed of unmonitored spending or unrestricted scope expansion? That gets a pass. Because nobody did anything. It just… happened.

Except it didn’t just happen. It happened because the organization never defined the boundaries within which strategy was supposed to operate. Without risk appetite, there is no early warning system. No trigger point. No moment where someone can say, “We agreed to X, and we’re now at Y. We need to stop and reassess.”

When you don’t define how much heat you’re willing to take, you will always take more than you should.

Risk Appetite Is a Strategy Conversation

This is the part most organizations get wrong. Risk appetite gets treated as a compliance exercise—something that belongs in the enterprise risk management framework, managed by a risk function, and reported to the board in a format that nobody finds particularly useful or actionable.

But risk appetite is not a risk conversation. It is a strategy conversation. One of the most important ones you will ever have.

According to a joint study by Baker Tilly and the IIA Foundation, six in ten enterprise risk management programs connect with strategic planning—but many fail to connect ERM insights with actual strategic decision-making. That’s a staggering gap. It means most organizations are generating risk information that never gets used where it matters most: in the room where strategic decisions are being made.

When risk appetite is properly defined, it does something incredibly powerful. It creates boundaries that enable agility rather than constraining it. This is counterintuitive to many leaders, who assume that defining limits means slowing down. The opposite is true. When your team knows the parameters—how much you can invest, how fast you can move, how much change the organization can absorb—they can make faster, more confident decisions within those parameters. Without them, every decision requires escalation, second-guessing, and the slow creep of risk that nobody authorized.

This is strategic agility. Not the buzzword version—not reactive pivoting dressed up in modern language. Real agility: the capacity to move quickly and confidently because you’ve already defined where the guardrails are.

Four Questions That Change Everything

In my work with CEOs and executive directors, I use the Essential Strategy Risk Appetite Framework—the ESRA Framework—to bring risk appetite into the strategic conversation where it belongs. The framework asks four deceptively simple questions, each tied to a core dimension of the strategic plan:

Essential Strategy

How much do we invest before the cost is too great? This is a Purpose question. It forces a conversation about the investment required to fulfill your mission and the point at which that investment begins to compromise other essential commitments. We measure it through resource allocation and spend relative to strategic return.

How fast can we get there without sacrificing value? This is a Growth question. It addresses the pace of expansion and the risk of outrunning your capabilities, your talent, or your market position. We measure it through performance metrics tied to core competencies and operational capacity.

To what extent are we willing to change? This is an Evolution question. It confronts the reality that change has a carrying cost on culture and people. We measure it through organizational readiness indicators—employee engagement, retention, and cultural alignment.

What threats have the potential to disrupt the critical path? This is an Equilibrium question. It steps back from the individual dimensions of purpose, growth, and evolution to assess the broader landscape of risk that could derail your most important strategic priorities. We measure it through leading risk indicators rather than lagging performance metrics, and by the way imperatives for purpose, growth, and evolution are managed in equilibrium.

These four questions create a structure for conversation that most strategic planning processes skip entirely. They force leadership teams to get specific about what they are and are not willing to put at risk—before execution begins, not after the water is already boiling.

And here’s what makes this different from the typical risk tolerance statement buried in a compliance document: the ESRA Framework ties risk appetite directly to strategic imperatives. It’s not abstract. It’s not theoretical. It’s answering the question “what are we actually willing to bet on this specific goal?” in terms that are measurable, trackable, and actionable.

What AI Can See—and What It Can’t

This is where the conversation gets interesting—and where I think the AI-and-leadership discussion needs to go that it hasn’t yet.

Artificial intelligence is extraordinarily good at detecting the incremental patterns that the human brain normalizes away. It can track spending trends across time, flag variance from established thresholds, model the compounding effects of scope creep, and surface risk escalation patterns long before they show up in a quarterly report. In fact, AI is arguably the best early warning system available for exactly the kind of slow-creep risk we’re talking about.

But here’s the critical distinction:

AI can tell you the temperature is rising. It cannot decide how hot is too hot.

Risk appetite is a judgment call that you make in advance. It requires understanding the organization’s values, its tolerance for uncertainty, the morale of its people, the political dynamics of its board, and the lived reality of what it feels like to push a team to the edge of its capacity. None of that lives in a dataset. All of it matters enormously in determining how much risk is acceptable in pursuit of a given strategic objective.

This is why risk appetite must be defined before execution begins—not discovered along the way. AI can inform every phase of that process. It can surface historical patterns and external benchmarks that sharpen the initial conversation about how much risk is acceptable. It can monitor real-time variance against those thresholds once they’re set. And when conditions change—because they will—it can model the implications of adjusting those boundaries before you commit. At every stage, AI makes the conversation smarter. But at no stage does it replace the conversation itself.

Because the decision about how much to risk—how much to invest, how fast to move, how much change is too much—is not a calculation. It’s a leadership act. It requires the people in the room to weigh what the data cannot capture: the resilience of their team, the trust of their stakeholders, the cultural cost of pushing too hard. AI can hand you the thermometer. Only you can decide what temperature is too high—and you need to decide that before someone turns on the burner.

The Strategic Agility You Need

Strategic agility has become one of the most overused and least understood terms in leadership today. Somewhere along the way, it got conflated with speed, with pivoting, with the ability to change direction at a moment’s notice.

That’s not agility. It’s reactivity.

True strategic agility comes from knowing your boundaries so well that you can move freely within them. It comes from having answered the hard questions about risk before you’re in the middle of a crisis. It comes from building the discipline to monitor, measure, and course-correct in real time—not because something went catastrophically wrong, but because you defined the conditions under which you would pause and recalibrate.

This is the difference between agility and chaos. Agility is responsive. Chaos is what you get when nobody defined the playing field.

When risk appetite is woven into strategy design, the organization gains something rare: the ability to adapt without lurching. To absorb market shifts without existential panic. To evolve continuously rather than careening from one crisis-driven transformation to the next.

That’s not just agility. That’s Equilibrium—the dynamic balance between purpose, growth, and evolution that allows an organization to maintain its center even as the ground shifts beneath it.

What To Do When the Water Is Already Warm

“My spidey senses are tingling but I’m not sure why.” “Growth has been great, but I feel like we’ve unraveled a bit at the edges.” “Everyone tells me things are good, but I’m waiting for the other shoe to drop.”  These are real comments from clients who reached out for my help. In every case we found assumptions of risk boundaries without actual boundaries, and it was indeed causing problems that threatened not just the strategy, but sustainability.

If you’re reading this and thinking about your own organization, and conversations you haven’t had. If your “spidy senses” are tingling, ask yourself a few honest questions.

• Do you have clearly defined risk appetite statements tied to your top strategic goals?

• Does your leadership team know—specifically—how much you’re willing to invest, how fast you’re willing to move, and how much change the organization can absorb?

• Or are you operating on instinct, adjusting as you go, and hoping somebody will notice if the water gets too hot and ring the alarm bell in time?

The boiling frog problem is not a dramatic disaster. It’s not the sudden crisis that makes headlines. It’s the quiet, incremental erosion of strategic intent that happens when nobody draws the line. By the time you feel the heat, you’ve already spent more, pushed harder, and changed more than anyone agreed to, or that the organization could sustain.

The moves you intentionally make today may save moves you have no control over tomorrow. It starts with four questions, an honest leadership conversation, and the discipline to define your risk appetite before execution—not after.

Strategic agility is not how fast you can get out of boiling water, it’s the capability to stay out of it in the first place.

---

Erin Sedor is an executive advisor and strategic performance expert with 30+ years helping organizations integrate risk intelligence into strategy design. She is the creator of the Essential Strategy Risk Appetite Framework and the Quantum Intelligence model for adaptive leadership.