Chy Flynn on transitioning from operations into enterprise risk, building executive engagement, developing future risk leaders, and why communication and business understanding matter more than technical risk expertise.
In the latest Spotlight on Women in GRC podcast, host Lucy Montague speaks with Chy Flynn, Head of Enterprise Risk at Rolls-Royce, about what separates exceptional risk professionals from average ones. Having spent more than a decade leading enterprise risk functions across major organizations, including Network Rail, Pearson and now Rolls-Royce, she believes some of the most important capabilities in risk are developed outside the profession. In fact, many of the qualities she looks for when hiring future risk leaders have little to do with risk at all.
In this Spotlight on Women in GRC episode, Chy shares:
- Why operational and project management experience creates stronger risk professionals
- The skills she prioritizes when hiring risk talent
- Why communication and influence matter more than risk knowledge
- How leadership behavior shapes risk culture
- Why risk should be directly linked to business objectives
- The growing role of resilience and AI in enterprise risk management
- How organizations can better support women into leadership positions
The best risk professionals don’t always start in risk
When people imagine a career in enterprise risk management, they often picture a linear journey through governance, compliance, controls and assurance. Chy’s route was very different:
“I actually started in the operations and then the project and program management space. So I took quite an unusual route through to enterprise risk.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
Looking back, she believes those experiences gave her something incredibly valuable: an understanding of how organizations actually function. Enterprise risk leaders rarely spend their days focused on one discipline. Instead, they operate across every area of the business:
“In ERM, when you’re in a central function and a group function, you can be talking about totally different topics. Sometimes it might be operations and delivery, then it could be treasury, then it could be strategy.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
This breadth creates a challenge for organizations building risk teams. Technical expertise matters, but understanding how people make decisions, how departments interact and how strategy translates into execution can be just as important.
That is why Chy believes operational and project experience often creates exceptionally strong risk professionals. Project leaders are used to balancing competing priorities. Operational leaders understand execution challenges. Program managers spend their lives navigating uncertainty and bringing people together around a shared objective. Those skills transfer remarkably well into enterprise risk.
For professionals aspiring to leadership roles, Chy’s advice is simple:
“There’s no way around it and you have to get out there and go and meet and talk to people.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
The best risk professionals aren’t confined to governance meetings and reporting packs, they spend time understanding the business they are there to support.
The key skills to look for when hiring your risk team
Many hiring managers focus heavily on technical risk knowledge, Chy takes a different view:
“The risk bit, you can actually teach that quite easily. The fundamentals are pretty easy. But the application of them is not.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
That statement challenges one of the biggest assumptions in the profession. Risk frameworks can be learned, methodologies can be trained and reporting processes can be documented. The qualities that are harder to teach are the ones Chy values most:
- Commercial awareness
- Strategic thinking
- Communication skills
- Relationship building
- Critical thinking
- Influence
- Curiosity
As she explains:
“Commercial mindset, being able to put the pieces of the jigsaw together in a strategic way, being able to influence and talk to people at all different levels of the organization.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
This reflects how the role of risk management is evolving.
Organizations no longer need risk teams that simply identify problems. They need professionals who can translate complexity into meaningful business decisions. The most effective risk leaders are able to walk into a boardroom, understand competing priorities and frame risk in a way that resonates with different stakeholders. In other words, risk management is becoming increasingly human.
GARP’s Global Risk Careers Survey reinforces the importance of these human capabilities: 66% of respondents cited interpersonal, communication, presentation and other soft skills as important for maintaining their current role or supporting future advancement.
Why risk culture starts at the top
Risk frameworks may establish structure, but culture determines whether risk management succeeds. After leading enterprise risk functions for more than a decade, Chy believes there is one predictor of successful risk management above all others:
“If I had to pick one thing that was a key success criteria, it would be tone from the top.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
The organizations that manage risk effectively tend to have leaders who actively participate in discussions rather than delegate ownership elsewhere. According to Chy, there is a visible difference between organizations where leadership genuinely owns risk and those where risk remains a compliance exercise.
“The leader’s engaged and they’re asking and putting people on the spot and they’re asking, ‘How can I help fix this? What do you need from me?’”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
When leaders ask questions, challenge assumptions and engage with uncertainty, risk conversations become valuable.
When they don’t, risk reporting can quickly become a box-ticking exercise. How do you combat this? One particularly powerful example from Chy’s experience involved recreating a historical organizational event using current reporting mechanisms.
The exercise helped leadership teams understand how warning signs could have been identified sooner.
“That had a massive impact because they looked at it and realized they should have known.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
The lesson was clear through the power of contextualized data and story telling, people rarely engage with risk because of methodology alone. KPMG’s Future of Risk report found that 67% of Chief Risk Officers and risk professionals said risk data increases awareness and understanding of potential risks and their organizational impact. Connecting that data to real business outcomes gives leaders a clearer reason to engage.
Risk only matters when it is connected to objectives
One topic that particularly resonated with Chy was the idea of linking risk directly to organizational objectives. Too often, risk registers become disconnected from strategy.
Risks are categorized, scored and reported, but not always connected to what the organization is actually trying to achieve.
Chy attended the launch of BRAVE and CoreStream GRC’s Objectives@Risk solution launch, and the Head of Enterprise Risk Management noted:
“It was one of the first times I’ve seen a GRC space trying to tackle that fundamental principle of enterprise risk.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
For Chy, enterprise risk works best when risks are viewed through the lens of strategic objectives. That approach helps leaders understand not just what might go wrong, but what could prevent success. At Rolls-Royce, one of the clearest examples is safety:
“One of our absolute top strategies is zero harm.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
The objective itself is simple.
“It’s everyone home safe every day.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
That clarity helps create a direct connection between strategy, decision-making and risk management. Rather than existing as a separate governance process, risk becomes part of achieving business outcomes.
GRC Pundit Michael Rasmussen, also agrees with this concept, stating:
“Risk management should not be the handbrake on the business. It should be the navigation system that helps the business move forward, steer through uncertainty, and achieve its objectives.”
Michael Rasmussen, GRC Analyst & Pundit, GRC 2020
The future of enterprise risk is resilience and adaptability
As organizations navigate increasing uncertainty, Chy believes resilience is becoming one of the most important capabilities in modern enterprise risk management.
Organizations must be prepared to respond, adapt and recover quickly when challenges emerge. Deloitte’s 2026 Global Human Capital Trends survey found that 7 in 10 business leaders see speed and adaptability as their primary competitive strategy for the next 3 years, underscoring why resilience must be an organizational capability, not simply a contingency plan
“You want to be adaptable. It’s not just status quo. You want to be fleet and agile and respond to the external world very, very quickly.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
This requires a mindset shift. Resilient organizations are not those that avoid every risk. They are the organizations that can absorb change and continue moving forward. For risk teams, this means focusing less on prediction and more on preparedness, adaptability and decision-making. The ability to learn quickly may become one of the most valuable risk capabilities of all.
The future of ERM technology: Connected decisions, not more data
Technology is transforming enterprise risk management, but Chy believes many organizations focus on the wrong criteria when evaluating ERM platforms.
Too often, conversations center around dashboards, reporting functionality or the volume of information a system can store. The real challenge, however, is helping leaders connect the dots between objectives, risks, controls and actions.
As Chy points out:
“Every company I’ve worked in, the committee packs are huge.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
The problem is rarely a lack of information.
Most organizations already generate vast amounts of risk, compliance, audit and performance data. The challenge is turning that information into meaningful insight that supports decision-making. That’s why one of the key things Chy looks for in an ERM platform is the ability to bring different elements of governance together.
“Think about drawing the two things together.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
Rather than viewing risks, controls, actions and objectives as separate exercises, effective risk management requires organizations to understand the relationships between them.
This is one reason Chy was particularly interested in CoreStream GRC’s Objectives@Risk approach.
When evaluating enterprise risk management software, she recommends focusing on three key areas:
User experience
The best risk platform in the world has little value if people do not want to use it. Risk teams are often asking colleagues across the business to contribute information, update risks, review actions or complete assessments. If the system is difficult to navigate, adoption will suffer. For Chy, usability is critical. People should be able to access the information they need quickly, understand what is required of them and complete tasks without extensive training or support. A good user experience encourages engagement. A poor one turns risk management into a compliance exercise.
Flexibility
No two organizations manage risk in exactly the same way. Business structures, governance models, reporting requirements and risk methodologies all vary, which means organizations should be cautious of solutions that force them into rigid processes. Chy highlighted the importance of selecting technology that can adapt alongside the business. As organizations grow, restructure or face new challenges, their approach to risk management will inevitably evolve. The right platform should support that evolution rather than requiring costly workarounds or process compromises.
Connectivity
Perhaps most importantly, Chy believes ERM technology should not operate in isolation. Risk data becomes significantly more valuable when it is connected to other information across the organization, whether that is controls, actions, incidents, audit findings, compliance obligations or strategic initiatives. Leadership teams rarely make decisions using risk information alone. They need a holistic view of what is happening across the organization. The more effectively systems connect information, the easier it becomes to understand relationships, identify trends and make informed decisions.
AI
These principles become even more important as artificial intelligence begins to play a larger role in governance, risk and compliance. Rather than replacing risk professionals, Chy sees AI as an opportunity to reduce administrative burden and improve efficiency. One of the most immediate benefits has been report writing and reviews.
“Papers, writing and reviewing papers. It’s so much faster.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
She has also seen AI improve emerging risk analysis, helping teams identify themes, challenge assumptions and accelerate research activities: “My emerging risk paper this year has moved on for sure because of it.”
For risk teams facing increasing expectations and limited resources, the combination of flexible, connected technology and responsible AI could significantly improve productivity. However, Chy is clear that technology remains an enabler, not a replacement for experience and judgement.
The future of risk management will still depend on people asking the right questions, influencing decisions and helping leaders navigate uncertainty. Technology simply gives them more time to focus on those activities.
Conclusion: Great risk leaders are business leaders first
One of the most powerful messages from Chy’s interview is that enterprise risk has never really been about risk alone. The professionals who thrive are not necessarily those with the most technical expertise.
They are the people who understand strategy, build relationships, communicate effectively, influence decisions, connect information from across the organization, and help leaders navigate uncertainty with confidence.
As Chy puts it:
“If I believe that they’ve got all the information and made that decision with their eyes wide open, then I’ve done my job.”
Chyono Flynn, Head of Enterprise Risk Management, Rolls-Royce
Ultimately, the future of enterprise risk will belong to professionals who can combine risk knowledge with commercial thinking, strategic awareness and human connection.
About Chy Flynn
Chy Flynn is Head of Enterprise Risk at Rolls-Royce and has more than a decade of experience leading enterprise risk management programs across complex, global organizations. Her career spans operations, project and program management, audit and enterprise risk, giving her a uniquely broad perspective on how organizations identify, assess and respond to uncertainty.
Prior to joining Rolls-Royce, Chy held senior enterprise risk leadership roles at Pearson PLC and Network Rail, helping organizations strengthen governance, improve decision-making and build resilient risk cultures. She is passionate about developing future risk leaders, connecting risk to strategy and ensuring risk management creates meaningful business value rather than simply fulfilling compliance requirements.
About Spotlight on Women in GRC
Spotlight on Women in GRC is a podcast series created to continue the conversations sparked by the Women in GRC Awards and carry those insights beyond the event. Supported by CoreStream GRC and hosted by Lucy Montague, the series shines a light on the women shaping governance, risk and compliance across the world.
Condensed transcript of the Chy Flynn podcast episode
Lucy Montague:
Welcome to Spotlight on Women in GRC, a podcast series created to continue the conversations sparked by the Women in GRC Awards. Supported by CoreStream GRC, the series shines a light on the women shaping governance, risk and compliance. Today I’m joined by Chy Flynn, Head of Enterprise Risk at Rolls-Royce. Chy, welcome.
Chy Flynn:
Thank you. It’s great to be here.
From operations to enterprise risk
Lucy Montague:
Can you start by telling us a little about your career journey and your current role?
Chy Flynn:
I currently lead Enterprise Risk at Rolls-Royce. I’ve been there for just over two years and before that I worked at Pearson and Network Rail. My route into risk wasn’t particularly traditional. I started in operations before moving into project and program management, then audit and eventually enterprise risk.
What I enjoy most about enterprise risk is the variety. In a central risk function, one conversation may be about operations and delivery, the next could be treasury, cybersecurity or strategy. You have to understand enough about every part of the business to facilitate meaningful conversations.
What makes a great risk professional?
Lucy Montague:
What skills do you think make someone successful in enterprise risk management?
Chy Flynn:
A commercial mindset is incredibly important, alongside the ability to put pieces of information together and see the bigger picture. Communication and influencing skills are also essential.
The risk bit you can actually teach quite easily. The fundamentals aren’t the difficult part. The challenge is applying them in the context of a complex business and helping people make better decisions.
I also look for curiosity. Nobody can know everything. You need people who ask questions, challenge assumptions and take the time to understand how the organization operates.
Why risk culture starts with leadership
Lucy Montague:
You’ve worked in several large organizations. What separates organizations with strong risk cultures from those that struggle?
Chy Flynn:
If I had to pick one thing, it would be tone from the top.
You can normally tell very quickly whether leaders genuinely value risk management. The best leaders are engaged. They’re asking questions, challenging people and asking how they can help resolve issues.
When leadership ownership exists, risk management tends to be much more effective. When engagement is missing, risk can easily become a reporting exercise.
One thing I’ve done successfully in the past is recreate historical incidents using current risk reporting formats. When leaders see how warning signs could have been identified earlier, it helps them understand the practical value of good risk management.
Connecting risk to strategy
Lucy Montague:
A lot of organizations are trying to connect risk more closely with business objectives. How important is that?
Chy Flynn:
I think it’s fundamental.
Historically, many organizations have organised risks into categories that don’t necessarily align with what the business is trying to achieve.
One of the reasons I liked the Objectives@Risk concept is that it focuses attention on business outcomes. Risk management becomes part of delivering strategy rather than something that sits alongside it.
At Rolls-Royce, one of our key objectives is zero harm. It’s a simple objective, but it’s powerful because everybody understands it. Ultimately it’s about getting everyone home safely every day.
What should organizations look for in an ERM platform?
Lucy Montague:
You’ve implemented and used a number of risk management systems. What advice would you give to organizations evaluating ERM technology?
Chy Flynn:
The first thing is user experience. If people don’t find the system easy to use, adoption becomes difficult.
The second is flexibility. Organizations evolve, governance structures change and risk processes develop over time. Technology needs to support that.
The third is connectivity. Every company I’ve worked in has enormous committee packs and huge amounts of information. The real challenge is bringing information together so leaders can see the relationships between risks, controls, actions and wider business activity.
How AI is changing risk management
Lucy Montague:
AI is obviously a major topic across GRC right now. How are you approaching it?
Chy Flynn:
We’re already seeing some really useful applications.
Writing and reviewing papers is significantly faster. AI can help structure content, improve drafting and speed up analysis. My emerging risk paper this year has definitely benefited from using AI.
The key thing, though, is that AI supports people. It doesn’t replace judgment. Risk management is still about understanding context, asking the right questions and helping leadership teams make informed decisions.
Building resilience in an uncertain world
Lucy Montague:
What do you think the future of enterprise risk management looks like?
Chy Flynn:
Resilience will continue to be a major focus.
The world is changing quickly and organizations need to be adaptable. It’s not about maintaining the status quo. It’s about being agile enough to respond to changing circumstances and emerging threats.
The organizations that succeed will be the ones that can absorb disruption, learn quickly and continue moving forward.
Supporting women into leadership
Lucy Montague:
What more can organizations do to support women into leadership positions?
Chy Flynn:
Progress has been made, but there are still challenges.
In many cases, women continue to carry a greater proportion of caregiving responsibilities, whether that’s childcare or caring for family members.
Small practical changes can make a big difference. Flexible working, hybrid environments and thoughtful scheduling all help create leadership opportunities that are accessible to more people.
Ultimately, organizations benefit when they build diverse leadership teams and make progression possible for talent from all backgrounds.
Final advice
Lucy Montague:
Finally, what advice would you give to somebody looking to build a career in risk?
Chy Flynn:
Don’t worry about knowing everything because you never will.
Spend time understanding the business, building relationships and staying curious. Get out, meet people and learn how the organization works.
The technical aspects of risk can be taught. Developing commercial awareness, influence and good judgement takes longer, but those are the skills that will really help you succeed.
Lucy Montague:
Chy, thank you for joining us.
Chy Flynn:
Thank you for having me.
Frequently asked questions about enterprise risk management
According to Chy Flynn, the best enterprise risk professionals combine technical risk knowledge with commercial awareness, strategic thinking, communication skills and the ability to influence stakeholders. While risk frameworks can be taught, the ability to connect information across the business and support better decision-making is often what differentiates exceptional risk leaders.
Not necessarily. Many successful GRC professionals transition from operational, project management, audit, finance or business leadership roles. Experience understanding how organizations function can be just as valuable as formal risk management experience.
Risk professionals must communicate complex information to different audiences, including executives, operational teams and boards. Strong communication skills help organizations understand risk, make informed decisions and build a stronger risk culture.
Enterprise Risk Management (ERM) is a structured approach to identifying, assessing, managing and monitoring risks that could impact an organization’s ability to achieve its objectives. Effective ERM helps leaders make informed decisions and balance risk with opportunity.
Risk culture influences how employees and leaders think about, discuss and respond to risk. Organizations with strong risk cultures are more likely to identify issues early, make informed decisions and integrate risk management into everyday activities.
Tone from the top refers to the behaviors, attitudes and actions demonstrated by senior leaders. When executives actively participate in risk discussions and visibly support good risk management practices, employees are more likely to do the same.
Organizations can improve engagement by linking risks to strategic objectives, using clear reporting, presenting real-world examples and focusing discussions on business outcomes rather than risk methodology alone.
Chy recommends evaluating enterprise risk management software based on three key factors:
User experience
Flexibility
Connectivity
The best ERM platforms are easy to use, adaptable to changing business needs and capable of connecting risks, controls, actions, assurance and objectives.
Many organizations are using AI to support report writing, emerging risk analysis, horizon scanning, theme identification, research and data analysis. AI can reduce administrative burden and help risk professionals spend more time supporting decision-making.
Organizational resilience is the ability to anticipate, respond and adapt to disruption while continuing to achieve strategic objectives. Resilient organizations focus on agility, preparedness and continuous learning rather than simply avoiding risk.
Effective risk management helps organizations identify uncertainties early, make informed decisions, protect strategic objectives and respond confidently to change. Rather than slowing organizations down, modern risk management should enable better and faster decision-making.
Future risk leaders will need a combination of:
Strategic thinking
Commercial awareness
Communication skills
Data literacy
Critical thinking
Stakeholder management
Leadership and influence
Understanding of AI and emerging technologies
As organizations become more interconnected, these skills will become increasingly important alongside traditional risk management expertise.
Risk management typically focuses on specific risks within a department, project or function. Enterprise Risk Management (ERM) takes a broader view by assessing risks across the entire organization and aligning risk oversight with strategic objectives.
