Risk management is not what it used to be. What was once a back-office checklist of compliance and controls is now a frontline player in a world of cyber threats, regulatory curveballs and market shocks. The old playbook, which is to react, report, repeat, will not cut it anymore. Organizations need a risk function that does not just survive the future but shapes it. This means cultivating a culture that breathes risk awareness, embedding behaviors that make frameworks like the three lines of defense work in harmony and investing in people who can think ahead, not just catch up. Here are some ideas on how to get there.