Beyond the Risk Register: 9 Risks That Must Shape Board Decisions Across East Africa

Most organisations have a risk register. Far fewer can point to a decision it has changed. In a 2026 AICPA and NC State study of 331 senior leaders, only 11% said their risk management process gives them a unique strategic or competitive advantage. Only 30% described their risk oversight as mature or robust, and only 29% had formally articulated a risk appetite in their strategic planning.

This Board Insight from our Risk Advisory Services team in Rwanda is written for boards, chief executives and finance leaders of organisations operating in Rwanda, with comparisons from Kenya where they help. It is built around one question: when your risk register tells you something, does it ever change a decision?

Nine risks that must shape board decisions

1. Cybersecurity and data protection. Rwanda requires a personal-data breach to be notified to the NCSA within 48 hours, while Kenya allows 72, so one incident can start two clocks at once.
2. Financial and liquidity. Contractors in Rwanda report waits of 60 to 120 days or more for payment, and the National Bank of Rwanda's key rate now stands at 8.75%.
3. Regulatory and compliance. Since 2 October 2026, the CMA's Regulations No 002/CMA/2026 have turned corporate governance good practice into binding minimum standards.
4. Supply chain and third parties. 30% of confirmed breaches in Verizon's 2025 Data Breach Investigations Report involved a third party, twice the previous year's share.
5. People and key persons. Approvals, client relationships and system knowledge that rest with a single individual.
6. Governance and directors. Only 22% of leaders say their risk processes engage leadership on risks five to ten years ahead.
7. Reputation and intangible assets. Intangible assets make up about 92% of the market value of the S&P 500.
8. Geopolitical and external. Inflation in Rwanda reached 17.2% in September 2026, with energy prices up 45%.
9. ESG and sustainability. ICPAR's roadmap phases in ISSB-based sustainability reporting by group, with full ISSB reporting for the first group in 2027.

For each risk, the article sets out the evidence, a decision question for the board and one practical first step.

From risk registers to risk-informed decisions

The article proposes a short five-step check to attach to every significant board or management decision: name the decision, find what could change the outcome, put ranges on it, compare it with risk appetite, and set triggers and owners. It closes with a 90-day action plan that a board or executive team can adopt without a large project or a new budget, and three simple measures to show whether it is working.

How BDO can help

Our Risk Advisory Services team in Rwanda supports boards and executives with risk-informed decision reviews, board risk reporting, data protection and cyber governance, third-party and supply chain risk, and ESG and sustainability readiness. To discuss where your organisation stands, call +250 788 309 225 or +250 738 304 070, or email rwanda@bdo-ea.com.

Related reading: Rwanda's corporate governance rules are now binding: what boards need to know and Beyond the Breach: how to build unshakeable cyber resilience.

Download the full Board Insight below for the evidence, decision questions and first steps for all nine risks.

Authors: Clement Niyitegeka, Partner; Solomon Kiplimo, Supervisor; Shami Vanessa Nice, Communication Officer. BDO East Africa (Rwanda) Ltd.